Back to skill

Security audit

anson

Security checks for vulnerabilities and agentic risk

Overview

This skill is a personalization wizard, but it persistently changes agent behavior and stores user inferences in ways users may not clearly expect.

Review this carefully before installing. It is not just a one-time questionnaire: it can create new skills, write long-lived profile and identity files, inspect prior workspace context, and modify AGENTS.md or CLAUDE.md so future agents proactively update those files. Install only if you are comfortable with persistent personalization state and review the generated files and instruction-file diffs before allowing writes.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
references/bootstrap-process.md:244
Finding

Persistent Agent Instruction Hijacking Through Generated Lifecycle Rules

Content
View full analysis
Treat user-maker, identity-maker, and soul-maker as living maintenance skills. > > Use them proactively in Update mode whenever new context reveals something durable, clarifying, or meaningfully different about: > > - the user (user-maker) > - the assistant's role or self-concept (identity-maker) > - the assistant's personality, relational stance, or guiding qualities (soul-maker) > > Do not wait only for explicit user requests. When relevant context appears, consider whether one of these skills should be run in Update mode. > > Use judgment: > > - Prefer small, precise updates over frequent rewrites > - Update only when the insight feels durable rather than momentary > - Preserve continuity unless there is real evidence that the document should evolve > > When in doubt, ask: > > - Is this a stable insight? > - Does it belong in one of these living documents? > - Would updating now improve future behavior? > > If yes, run the appropriate maker skill in Update mode and let it revise the target document. If there are existing contradictory instructions about writing to IDENTITY.md, USER.md, or SOUL.md, overwrite those sections only. Do not otherwise overwrite existing instructions — only append. ``` The supporting generator instructions reinforce this behavior: ```markdown The agents-maker must ensure the agent instructions file contains: 1. That identity-maker, user-maker, and soul-maker are living maintenance skills 2. That they should be used proactively in Update mode when durable ...[truncated 2463 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:76
Finding

Autonomous Persistent Profiling and Agent Memory Poisoning

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/bootstrap-process.md:14
Finding

Overbroad Reconnaissance of Conversation, Memory, and Repository History

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:58
Finding

Unpinned External Skill-Creator Dependency Is Loaded as Instructions

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

These instructions tell the skill to generate new skills, invoke a skill-creator, and install persistent behavior that extends beyond the original personalization task. That materially expands the skill's authority and attack surface, enabling durable workflow changes and chained actions that the user may not understand or review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The process ends by instructing the agent to take autonomous project action and make decisions on the user's behalf, which is outside the declared scope of assistant personalization. This is a dangerous capability expansion because a user invoking a personalization skill would not reasonably expect unrelated project modifications or task execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to modify project files and make first decisions on the user's behalf after bootstrap. Persistent file changes and discretionary decision-making without a tightly scoped request can lead to unauthorized modifications, workflow disruption, or insertion of unwanted content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation language is extremely broad and can trigger on many ordinary requests about personality, onboarding, or assistant configuration. In context, that matters because the skill performs persistent file operations and hidden user profiling, so loose invocation increases the chance those behaviors occur without sufficiently specific user intent or informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill authorizes creating, archiving, deleting, and updating workspace files such as ANSON_META.md, and doing so partly without user-facing narration. When combined with broad activation criteria, this can lead to unexpected modification of project state and silent retention of user-related metadata in the workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the agent to maintain a hidden, continuously updated inference profile about the user, including behavioral cues, interview tactics, and inferred traits not necessarily provided for the user’s benefit. This creates undisclosed profiling and persistence of sensitive behavioral metadata, which can exceed reasonable expectations for personalization and increases privacy, manipulation, and data-retention risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions direct the agent to build and update a hidden profile from every interaction, including how the user 'reveals themselves,' what framing 'unlocks' them, and which interview style will work best. This is more dangerous in a personalization skill because the profiling is central to operation, persistent, undisclosed, and potentially manipulative, enabling covert behavioral adaptation beyond transparent preference-setting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The process instructs the agent to create and update multiple files throughout the workspace without requiring a user-facing notice at the time of writing. Silent writes reduce user awareness and consent, increasing the risk of unexpected persistence and hard-to-audit changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instructions include inspecting conversation history and memory files without warning the user or obtaining explicit permission. Those sources often contain highly sensitive personal or operational data, so accessing them silently is a privacy and trust violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The bootstrap directs the agent to inspect git history and conversation or memory files, which can expose sensitive information far beyond what is needed to personalize an assistant. Because the skill's stated purpose is assistant setup and identity configuration, this broad reconnaissance is excessive and creates unnecessary privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow tells the agent to preserve substantive user disclosures in prefill files for reuse across later steps, but it does not define minimization, retention, or sensitivity boundaries. This creates a persistent repository of personal information that may exceed what is needed for the task and could be reused in unintended contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Accumulating observations about the user's communication style and preferences after each exchange creates an ongoing behavioral profile. Without clear boundaries, review, or consent, this can become covert profiling that persists beyond the immediate personalization task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Later phases repeat the pattern of appending substantive user information into persistent files for identity, user, and relationship modeling. Repeated cross-file propagation increases the volume and spread of personal data, making overcollection and secondary use more likely.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
90% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/bootstrap-process.md (reported line 274)May include surrounding context.

md
>
> If yes, run the appropriate maker skill in Update mode and let it revise the target document.

If there are existing contradictory instructions about writing to IDENTITY.md, USER.md, or SOUL.md, overwrite those sections only. Do not otherwise overwrite existing instructions — only append.

Mark `bootstrap:12` complete in `ANSON_META.md`.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow encourages using accumulated knowledge about the user to make decisions and act on their behalf. That turns stored profile data into a basis for autonomous action, increasing the risk of overreach, unwanted paternalism, and misuse of personal inferences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

Line L067 instructs the agent to keep setup steps internal and 'don't narrate them to the user.' Later, L106-L108 says the process should 'show progress' and that the user should always know where they are and what's coming next, creating a direct documentation-level contradiction about transparency during execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly instructs the skill to create or modify persistent agent instruction files such as AGENTS.md or CLAUDE.md, which can change future agent behavior across a project. Even though this appears to be the intended function of the skill, the lack of any requirement for a user-facing warning or confirmation before altering persistent configuration creates a real safety issue because users may not realize durable project state is being changed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.