Expert Mode

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.9.0

Overview

The skill is mostly aligned with its expert-advisor purpose, but it gives broad file-writing and documentation-update authority that users should review before installing.

Install only if you want an agent to manage project-local expert rosters and dossier files. Before use, require confirmation for any file creation or update, and do not allow it to modify installed skill documentation or persistent agent behavior without explicit human review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a runtime expert-advisor skill that provides virtual experts, technical critique, strategic analysis, and related decision-support behavior. The supplied code does none of that. It simply scaffolds a markdown dossier template for defining an expert archetype later. Its primary purpose is content/template generation and file output, not expert consultation. While dossier scaffolding may support the broader expert-mode system, this specific code chunk materially differs from the declared purpose and introduces a concrete file-writing utility that is not what the description says the skill does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents an interactive expert-mode advisory/review system that supplies virtual experts, strategic/technical critique, and decision support. The code does not implement any expert reasoning, personas, advisory output modes, or trigger handling. Instead, it validates local markdown files under experts/ for presence and structure, extracts dossier paths from roster.md, and emits errors/warnings, including checks for suspicious authority-style phrases. This is a materially different primary purpose, so the description does not accurately represent the code.

Self-Modification

High

• Category: Rogue Agent

Content

5. Add the dossier to the roster.
6. Load that dossier immediately if the user asked it to advise now.
7. Ask the custom expert to produce project-specific advice.
8. Add or update skill docs if the custom expert implies a reusable mode or pattern.

## Custom expert intake fields

• Confidence: 95% confidence
• Finding: The instruction to 'Add or update skill docs' gives the mode authority to modify its own operational documentation based on runtime user requests. This is a classic self-modification risk: a malicious or manipulative prompt could cause persistence of unsafe behaviors, broaden triggers, weaken safeguards, or implant adversarial instructions into future executions.

Self-Modification

High

• Category: Rogue Agent

Content

out = Path(args.out)
    if out.exists() and not args.force:
        raise SystemExit(f"Refusing to overwrite existing file: {out} (use --force)")
    out.parent.mkdir(parents=True, exist_ok=True)
    out.write_text(render(args.title, args.slug, args.project), encoding="utf-8")
    print(out)

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs the agent to read and potentially create or update project-local files like `experts/roster.md` and `experts/dossiers/*`, but it does not declare any explicit tool scope or permission boundary. That mismatch can cause the skill to perform filesystem actions users or policy layers did not clearly authorize, increasing the risk of unintended file modification or over-broad access.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance includes many broad, everyday phrases like requests for review, analysis, planning support, advisors, and second opinions, which weakens activation boundaries. Over-broad triggers can cause the skill to activate unexpectedly in unrelated conversations and may lead to unnecessary file reads/writes or persona-loading behavior without clear user intent.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The search/listing summary enumerates many generic discovery phrases that overlap normal user requests, making accidental invocation more likely. In the context of a skill that can inspect project files and create/update local dossiers, ambiguous activation increases the chance of unintended context loading, file churn, or mis-scoped operations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation criteria are intentionally expansive, including vague phrases like requests for expert perspectives, strategic analysis, technical analysis, and planning support. In an agent setting, this can cause the skill to activate on ordinary user requests that did not intend to invoke this workflow, leading to inappropriate context loading, unnecessary file reads, and behavior changes that may expose project information or alter decision-making unexpectedly.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger patterns are broad and include common conversational phrasing such as requesting an expert or stakeholder, which can cause the mode to activate unintentionally. In an agentic system, unintended activation can silently change behavior, introduce unrequested personas, and expand the system’s authority or workflow in ways the user did not clearly consent to.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example trigger phrase "activating expert mode" is very broad and can cause the skill to engage in situations where the user did not clearly request multi-expert behavior or understand its implications. In a skill that can create experts, load project context, and influence decision-making, ambiguous activation increases the risk of unintended context expansion, overreach, or application to sensitive tasks without sufficient gating.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Reusing the same broad activation phrase in a high-risk scenario is more dangerous because it normalizes invoking the expert system for sensitive policy design without clear preconditions or approval boundaries. Even though the example mentions human review, the trigger itself remains under-scoped, which could lead an agent to apply authoritative-seeming guidance in legal, privacy, or compliance contexts too easily.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase "expert mode" is broad enough to match ordinary user language that may not actually intend to activate this skill. In a skill that changes response style and context-loading behavior, accidental activation can cause inappropriate routing, unnecessary context retrieval, or expert/persona framing when the user only meant generic discussion.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The Quick and Deep mode guidance relies on natural-language triggers that are similar and not tightly bounded, which can lead to selecting the wrong response-depth mode. This is mainly a control-flow and quality/scope issue, but in this skill it can also affect how much context is loaded, potentially increasing unintended data exposure or causing overbroad analysis behavior.

Static analysis

No suspicious patterns detected.