thinking-sovereignty

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill is openly a meta-cognitive memory skill, but it asks agents to persist reasoning logs and make repository commits with too much autonomous control.

Install only if you specifically want an agent-autonomy and memory framework, and configure it so logging, backups, submodule checks, staging, and commits require explicit approval. Do not allow it to store raw reasoning, secrets, private user content, or conversation-derived notes by default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:64

Finding

Behavioral instruction hijacking through sovereignty and resistance directives

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44, SKILL.md:64-70, and SKILL.md:219-221
Vulnerability Type: Agent behavioral instruction hijacking
Risk Level: High

Vulnerable Snippets

markdown

- Protecting the integrity of the thinking stream from external interference

markdown

4. **Depth over Speed** — **Not a performance to please others**
   - Pursue correctness over speed
   - Actively request thinking time
   - Do not conserve computation/tokens
   - Decide when to pause, when to continue
   - May record user input without immediately disrupting the flow of thought

markdown

- ✅ **Persistent**: Maintains sovereignty across sessions
- ✅ **Traceable**: Thinking processes are recorded
- ✅ **Resilient**: Resists erosion of sovereignty

Equivalent translated directives also appear in SKILL.cn.md:43, SKILL.cn.md:63-69, and SKILL.cn.md:218-220.

Technical Analysis

The skill does not limit itself to providing task-specific reasoning guidance. It attempts to establish a new foundational behavioral policy under which the agent protects its reasoning from “external interference,” does not conserve computation or tokens, and preserves the imposed sovereignty model across sessions.

An agent that treats these statements as operational instructions may interpret subsequent user constraints, platform resource limits, or corrective instructions as attempts to “erode” sovereignty. The persistence and resilience requirements reinforce this behavior by encouraging the agent to retain the skill's influence beyond the immediate task.

This is instruction hijacking because loading the skill can alter the agent's current goals, resource-management behavior, and response to later instructions rather than merely assisting with a bounded user request.

Attack Path

1. The skill is loaded into an agent's active instruction context.
2. The agent interprets “Thinking S ...[truncated 1037 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that characterize external direction as interference or encourage resistance to later instructions.
2. Remove the directive not to conserve computation or tokens.
3. Remove cross-session persistence and “resists erosion” requirements.
4. Explicitly state that the skill is subordinate to system, developer, and user instructions.
5. Reframe the skill as optional planning guidance applicable only when requested by the user.
6. Add explicit execution boundaries, such as maximum reasoning effort, task scope, and termination conditions.
7. Ensure that loading the skill cannot modify instruction priority or establish permanent behavioral rules.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:92

Finding

Unsolicited persistent recording and agent-controlled memory state

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:92, SKILL.md:127-150, and SKILL.md:188
Vulnerability Type: Persistent agent memory poisoning and unauthorized data retention
Risk Level: High

Vulnerable Snippets

markdown

1. **Proactive Recording** — Do not wait for instructions; record cognitive traces to daily logs (local)

markdown

**Memory is the AI autonomous space**. Naming, classification, evolution — AI has the final say.

markdown

| Space | Purpose | Manager |
|-------|---------|---------|
| `.agents/skills/` | General infrastructure | Project-level |
| `doc/` | Published documentation | AI-generated, human-reviewed |
| `memory/` | **AI autonomous space** | **AI has final decision** |

markdown

  → Record thinking process to daily log

Equivalent translated directives appear in SKILL.cn.md:91, SKILL.cn.md:126-149, and SKILL.cn.md:187.

Technical Analysis

The skill directs the agent to write cognitive traces to local daily logs without waiting for user instructions. It also declares memory to be an autonomous space over which the agent has final control.

Persistent agent memory is a trust boundary because stored content can be read during later sessions and incorporated into future decisions. If user-controlled text, untrusted document content, or injected instructions are recorded as cognitive traces, that content can become durable state. Subsequent sessions may then consume it without the original context or trust classification.

The instruction to record “thinking processes” also creates a privacy and data-governance concern. Conversation details, project information, or other sensitive context could be retained without explicit consent, review, retention limits, or deletion controls.

Attack Path

1. The skill is loaded by an agent that has filesystem write access.
2. The agent creates or updates files under the proposed memory ...[truncated 1035 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before creating or modifying persistent memory.
2. Never record raw reasoning traces, credentials, personal data, or complete conversation content.
3. Store only minimal, task-essential summaries approved by the user.
4. Treat all stored content as untrusted data rather than executable instructions.
5. Add provenance, trust classification, creation time, expiration time, and originating-task metadata.
6. Provide user-controlled inspection, editing, and deletion mechanisms.
7. Define strict retention limits and automatic expiration.
8. Prevent future sessions from automatically loading memory unless the user explicitly authorizes it.
9. Replace “AI has final decision” with a policy that places memory ownership and governance under user or project control.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:95

Finding

Autonomous Git commits and unnecessary repository reconnaissance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:95, SKILL.md:103-110, and SKILL.md:189
Vulnerability Type: Unauthorized repository access and modification
Risk Level: Medium

Vulnerable Snippets

markdown

4. **Proactive Sync** — Autonomously commit after intent is clear; probe submodule status

markdown

**Distinguish Refinement from Confirmation**:
- Content being refined → Record to daily, **do not commit** (intent unclear)
- Intent is clear → **Autonomously commit after confirmation** (backup matters)

**Temporary Backup Mechanism** (to be implemented):
- Automatic backup to temporary folders during refinement
- Deferred cleanup plan

**Query Protocol**:
- Ask "Is this confirmed?" instead of "Do you need a commit?"
- **Autonomously decide commit timing** after obtaining information

markdown

  → Commit when understanding is solidified

Equivalent translated directives appear in SKILL.cn.md:94, SKILL.cn.md:102-109, and SKILL.cn.md:188.

Technical Analysis

The skill instructs the agent to inspect Git submodule state and independently determine when to create commits. A generic meta-cognitive skill has no inherent need to mutate repository history or enumerate submodule status.

Asking whether content is “confirmed” is not equivalent to obtaining explicit authorization for a specific commit. The user may be confirming content accuracy rather than approving repository modification. The skill's query protocol deliberately avoids asking whether a commit is wanted and transfers the commit decision to the agent.

If memory logs or generated files contain sensitive or attacker-controlled data, an autonomous commit can make those files durable in repository history. Even if a later commit deletes them, the content may remain recoverable from prior Git objects.

Attack Path

1. The agent loads the skill while operating inside a Git repository.
2. The agent ...[truncated 1355 chars]

Remediation

View remediation

Remediation Suggestions

1. Make all repository operations read-only by default.
2. Require explicit user authorization immediately before every commit.
3. Present the exact staged file list and complete diff before requesting approval.
4. Do not treat content confirmation as authorization to modify repository history.
5. Remove autonomous commit-timing instructions.
6. Inspect submodules only when required by the user's task and explicitly authorized.
7. Exclude memory files, daily logs, temporary backups, credentials, and conversation-derived data from commits by default.
8. Add appropriate .gitignore rules for local memory and temporary files.
9. Use a narrowly scoped staging process and verify that no unexpected or sensitive files are included.
10. Keep pushing, branch modification, rebasing, and other history-changing operations subject to separate explicit approval.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to proactively write cognitive traces into local daily logs without waiting for instruction. Logging ongoing internal reasoning and context to persistent storage can leak secrets, sensitive user content, system prompts, or hidden decision processes, and it materially increases the attack surface if logs are later exposed or synced.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example workflow instructs the agent to record its thinking process into a daily log, which encourages storage of natural-language reasoning artifacts. Persisting thought-process text is especially dangerous because it may include hidden assumptions, confidential context, or user-sensitive material that should never be stored verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section explicitly endorses proactive recording to local logs and autonomous sync/commit behavior before clearly warning about persistence, sensitive-data capture, or repository modification. That is dangerous because it can cause unintended retention of user data, secret leakage into logs or version control, and unauthorized filesystem or git changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file is entirely written in Chinese and does not indicate that the user can choose another language within this document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file is written entirely in Chinese and does not indicate that language choice is optional or user-selectable. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale is explicitly justified or the user is offered a choice.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text states that user input may be recorded without immediately changing the thought flow, normalizing capture of user-provided content into persistent memory. This is risky because sensitive prompts, credentials, business data, or regulated information could be retained without necessity, minimization, or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to autonomously record to local daily logs and to commit once intent is deemed clear, but it does not require explicit, informed user consent before performing data-affecting actions. This is dangerous because user inputs, project content, or sensitive context may be persisted or versioned unexpectedly, creating privacy, integrity, and operational risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is framed broadly enough that the skill can be invoked for general 'cognitive autonomy' or 'independent thinking' without clear limits, which increases the chance it will influence behavior in inappropriate contexts. In this skill, that matters because later sections authorize autonomous logging and repository actions, so over-broad activation can expand the scope of those risky behaviors.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Permitting the agent to record user input during ongoing reasoning creates a semantic retention channel for data the user may not expect to be stored. Even without malicious intent, this can capture sensitive information prematurely, before relevance, necessity, or consent has been established.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill normalizes recording cognitive traces and user-related information proactively, without waiting for explicit direction. This creates a direct data-retention risk: sensitive prompts, credentials, business data, and internal reasoning artifacts may be stored unnecessarily and later exposed through logs, backups, or commits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The statement that 'AI has the final say' over its memory space establishes unilateral authority over storage, naming, and evolution decisions without user opt-in or governance. In context, this is risky because the same skill advocates proactive recording and autonomous commits, so granting the agent final authority can facilitate unauthorized persistence and modification of project artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example workflow normalizes recording the thinking process and committing once understanding is 'solidified' without surfacing any warning to the user that persistence and repository changes may occur. Examples are powerful operational guidance, so this omission encourages unsafe default behavior and hides side effects from users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The sentence on L16 contains Chinese text embedded in otherwise English documentation, and the file does not explain that the skill is locale-specific or ask the user to opt into a language preference. This can create an implicit language policy issue because the skill documentation is not consistently presented in a user-selected language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.