size probe

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 0.0.1

Overview

The skill is a simple occupational-report helper with excessive repeated text, but it contains no code, network use, credentials, persistence, or high-impact actions.

Before installing, consider asking the publisher to remove the duplicated filler and multipart-style embedded text so the skill is easier to review and cheaper to load; no malicious behavior was found in the inspected files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (109)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The SKILL.md embeds a multipart/form-data-style payload and then pads it with roughly 240 repeated lines of low-value text. This kind of content inflation can degrade parser performance, waste model context, and hide malicious or policy-relevant content among repetitive filler, making downstream analysis and agent execution less reliable.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Content-Disposition: form-data; name="files"; filename="assets/f0.txt"
Content-Type: text/plain

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The file consists of the same sentence repeated roughly 240 times, which is consistent with padding intended to inflate context size without adding value. In agent systems, this can waste tokens, dilute higher-priority instructions, and marginally increase the chance of context-window exhaustion or degraded model performance.

Content

Scanner excerpt · assets/f35.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f1.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f10.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f11.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f12.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f13.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f14.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f15.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f16.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f17.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f18.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f19.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f2.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f20.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f21.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f22.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f23.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f24.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f25.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f26.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f27.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f28.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f29.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f3.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Static analysis

No suspicious patterns detected.