Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md`
Security audit
Forever Healthy AI4L - AI for Practical Longevity
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed evidence-review helper that creates and audits Markdown reports, with no artifact evidence of hidden installation, exfiltration, privilege escalation, or destructive behavior.
Install only if you want an agent to create, audit, search for, and revise evidence-review Markdown files. Invoke commands explicitly, review outputs before relying on medical or longevity conclusions, and do not put secrets or private notes in ./results/ audit files because prior issue sections may be copied into later audits.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the auditor to perform a fresh, independent audit, but later requires incorporating content from prior audits. This creates instruction conflict and can contaminate the current analysis with stale, adversarial, or user-supplied data, weakening isolation between runs and increasing prompt-injection and data-propagation risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Requiring prior issues to be carried forward directly contradicts the earlier 'Start Fresh' rule and undermines audit integrity. An attacker could seed misleading or malicious content into an earlier audit, causing it to be replayed into future outputs and biasing or polluting subsequent reviews.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically extracting and re-emitting prior audit sections can propagate sensitive or unnecessary data from earlier artifacts into new outputs. Because prior audits may contain private notes, URLs, identifiers, or attacker-controlled text, this behavior creates a data-leakage and persistence channel across audit sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill uses generic trigger words like "verify," "create," and "audit" without requiring a scoped prefix or explicit confirmation that the user intends to invoke this skill. In a multi-skill or conversational environment, ordinary user language can accidentally activate file-reading or file-writing workflows, causing unintended actions and broadening the attack surface.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The VERIFY workflow says to fix inconsistencies automatically, which implies modifying multiple project files, but the skill does not present an upfront warning or require confirmation before changing them. Even though it limits edits outside ./results/ to cases with explicit permission, this command normalizes repair behavior that could surprise users and lead to unintended repository changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The FULL workflow chains creation, audit, and automatic fixing in one pass, causing multiple reads and writes without an explicit warning about the scope and number of file modifications. This increases the chance of unintended content changes and makes it easier for a casually phrased user request to trigger a larger automated mutation workflow than expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The ITERATE workflow can repeatedly audit and modify files for up to 10 cycles, but it does not clearly warn the user that this may result in repeated automatic writes. Repetitive autonomous editing magnifies the impact of mistakes, prompt misinterpretation, or poisoned audit outputs, and can produce substantial unintended changes before a user notices.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The statement that the skill "handles all Evidence Review workflows" is broad and does not clarify the exact scope, prerequisites, or limits of invocation. Because the file does not pair this with explicit trigger boundaries or exclusions, the activation scope remains ambiguous in the markdown description.
- Content
Static analysis
No suspicious patterns detected.