size probe

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 0.0.1

Overview

The skill is a content-only vocational education helper with excessive duplicated filler, but no code, credential use, network access, persistence, or hidden agent-control instructions were found.

This appears safe to install from a security standpoint, but users should expect low utility until the publisher removes duplicate filler, fixes the embedded multipart artifact, and provides clearer usage boundaries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (108)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The skill file embeds a multipart-style payload followed by hundreds of repeated filler lines, which is a classic padding technique used to bury meaningful content, evade review, or manipulate token/context windows. Even though the repeated text itself is benign occupational data, the excessive padding can degrade security analysis, hide later malicious instructions, and waste processing resources in downstream systems that ingest SKILL.md verbatim.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Content-Disposition: form-data; name="files"; filename="assets/f0.txt"
Content-Type: text/plain

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The file contains heavy repetitive padding, with the same line repeated roughly 240 times, which adds no functional value and can obscure meaningful content during review or automated scanning. Excessive padding can also be used to hide malicious instructions elsewhere in larger skill assets or waste context budget, reducing the reliability of downstream analysis and agent behavior.

Content

Scanner excerpt · assets/f66.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file content is an extremely repetitive, generic description that does not define specific activation boundaries, expected inputs, or safe operating scope. In an agent skill context, ambiguous scope can cause unintended triggering or misuse of the skill for requests outside its intended domain, increasing the chance of unsafe behavior or prompt-routing errors.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f1.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f10.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f11.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f12.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f13.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f14.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f15.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f16.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f17.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f18.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f19.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f2.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f20.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f21.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f22.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f23.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f24.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f25.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f26.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f27.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f28.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/f29.txt (reported line 1)May include surrounding context.

text

Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Static analysis

No suspicious patterns detected.