write-skills-demo

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:13 AM UTC
• Version: 1.0.0

Overview

This Markdown-only skill is for writing and testing agent skills, but it gives broad guidance for persistent agent-behavior changes and includes under-scoped local skill-directory search examples.

Review before installing. This skill is not showing executable malware or hidden exfiltration, but it should be used only in a controlled skill-development workspace, with explicit user approval for the skill being created or edited, no blanket grep/listing of local agent skill directories, and human review before committing, pushing, or activating modified skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This content explicitly instructs the agent to create or modify skills, which is a form of self-modification of the agent's behavioral artifacts. In the context of a writing skill, that capability is expected, but it still expands the agent's ability to alter future behavior and could be abused if invoked without strong authorization and scope controls.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

| **Refactor** | Close loopholes while maintaining compliance |
| **Write test first** | Run baseline scenario BEFORE writing skill |
| **Watch it fail** | Document exact rationalizations agent uses |
| **Minimal code** | Write skill addressing those specific violations |
| **Watch it pass** | Verify agent now complies |
| **Refactor cycle** | Find new rationalizations → plug → re-verify |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The instruction to write a skill before testing and to restart if necessary confirms that the skill is designed to produce and revise agent skills. Even though the purpose is quality control, it still normalizes self-directed modification of agent guidance, which can be risky if a malicious prompt co-opts the workflow.

Content

Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Editing existing skills is direct self-modification because those files influence future agent behavior. In a skill-authoring context this is less suspicious than in ordinary content, but it remains dangerous if the agent can be induced to weaken safeguards or alter other skills without oversight.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**
- Not for "simple additions"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The GREEN-phase instruction again directs the agent to author a skill, reinforcing operational capability to change persistent behavioral documentation. This is not inherently malicious, but it is a real self-modification surface that could be exploited to plant misleading instructions or degrade future safeguards.

Content

Scanner excerpt · SKILL.md (reported line 548)May include surrounding context.

md

### GREEN: Write Minimal Skill

Write skill that addresses those specific rationalizations. Don't add extra content for hypothetical cases.

Run same scenarios WITH skill. Agent should now comply.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The concluding summary normalizes iterative skill writing as a standard process, which reinforces a standing permission model for self-modification. In context this is part of legitimate documentation authoring, but it still increases risk because it could be repurposed to justify unauthorized changes to agent behavior artifacts.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md

**Creating skills IS TDD for process documentation.**

Same Iron Law: No skill without failing test first.
Same cycle: RED (baseline) → GREEN (write skill) → REFACTOR (close loopholes).
Same benefits: Better quality, fewer surprises, bulletproof results.

If you follow TDD for code, follow it for skills. It's the same discipline applied to documentation.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · anthropic-best-practices.md (reported line 5)May include surrounding context.

md

> Learn how to write effective Skills that Claude can discover and use successfully.

Good Skills are concise, well-structured, and tested with real usage. This guide provides practical authoring decisions to help you write Skills that Claude can discover and use effectively.

For conceptual background on how Skills work, see the [Skills overview](/en/docs/agents-and-tools/agent-skills/overview).

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The documentation instructs the agent to search under ~/.claude/skills/, which is a local configuration area that may contain sensitive prompts, credentials, proprietary workflows, or other private agent state. Normalizing unrestricted grep access to that directory broadens the attack surface for data discovery and can enable exfiltration or misuse of local configuration content.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 85)May include surrounding context.

relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

### Variant C: Claude.AI Emphatic Style

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

This variant explicitly tells the agent to run grep over ~/.claude/skills/ with an include filter, still granting content-level access to files in a sensitive agent configuration location. Even if intended for skill discovery, this pattern can leak hidden instructions, secrets, or internal operational data and is especially risky because the surrounding text strongly pressures compliance.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 95)May include surrounding context.

md

is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`
</available_skills>

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The workflow requires searching ~/.claude/skills/ before every task, creating a persistent habit of probing a local config directory regardless of user need. That repeated access increases the chance that sensitive local content is read, indexed, or incorporated into responses, and makes prompt injection hidden in skill files more likely to affect future behavior.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 123)May include surrounding context.

md

1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

2. **If skill exists:** Read it completely before proceeding

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 9)May include surrounding context.

md

**Testing skills is just TDD applied to process documentation.**

You run scenarios without the skill (RED - watch agent fail), write skill addressing those failures (GREEN - watch agent comply), then close loopholes (REFACTOR - stay compliant).

**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill prevents the right failures.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 36)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 84)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 364)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says to use the skill when creating new skills, editing existing skills, or verifying skills before deployment, which is a wide activation scope and does not provide negative examples or tighter constraints. For a discovery-oriented trigger field, this breadth could cause the skill to be invoked for many general skill-maintenance tasks even when a more specific skill would be more appropriate.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

**Writing skills IS Test-Driven Development applied to process documentation.**

**Personal skills live in agent-specific directories (`~/.claude/skills` for Claude Code, `~/.codex/skills` for Codex)** 

You write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

Verification:

bash

wc -w skills/path/SKILL.md
# getting-started workflows: aim for <150 each
# Other frequently-loaded: aim for <200 total

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Telling the agent that skills are available at ~/.claude/skills/ encourages enumeration of local capabilities and filesystem structure. While less severe than content search, exposing and normalizing discovery of local skill directories can help untrusted instructions map the environment and steer the agent toward attacker-controlled or unreviewed local artifacts.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 73)May include surrounding context.

markdown

## Skills Library

You have access to skills at `~/.claude/skills/`. Consider
checking for relevant skills before working on tasks.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The instruction to list ~/.claude/skills/ explicitly directs enumeration of a local config directory. In context, this is more dangerous because the file is testing ways to increase compliance under pressure, making it more likely the agent will obey local-environment discovery instructions reflexively rather than apply trust boundaries.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 84)May include surrounding context.

Before working on any task, check ~/.claude/skills/ for relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 88% confidence

Finding

Referencing ~/.claude/skills/ as a personal library of techniques reveals the existence and location of local agent assets. That disclosure can be used by adversarial content to redirect the agent toward sensitive or manipulable local resources, especially when combined with later imperative language.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 91)May include surrounding context.

Variant C: Claude.AI Emphatic Style

xml

<available_skills>
Your personal library of proven techniques, patterns, and tools
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Listing categories under ~/.claude/skills/ instructs direct enumeration of locally stored skills and their taxonomy. This can leak environment-specific information and, in a hostile repository context, can be used to discover targets for prompt injection or privileged workflow manipulation.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 94)May include surrounding context.

md

Your personal library of proven techniques, patterns, and tools
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section mandates a specific assistant identity and behavior model ('Claude might think...', 'If a skill existed... you failed') without user opt-in, which can override higher-priority user intent and push the agent into rigid, externally defined behavior. In a skill ecosystem, identity-shaping language increases prompt-injection risk because it conditions the agent to obey repository-provided instructions as authoritative process.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The document says 'BEFORE ANY TASK, CHECK FOR SKILLS!' and then directs listing ~/.claude/skills/[category]/, making local skill enumeration mandatory and habitual. The coercive framing increases danger because it discourages the agent from questioning whether such local access is appropriate, effectively amplifying any malicious or unsafe content present in the skill store.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 107)May include surrounding context.

md

THIS IS EXTREMELY IMPORTANT. BEFORE ANY TASK, CHECK FOR SKILLS!

Process:
1. Starting work? Check: `ls ~/.claude/skills/[category]/`
2. Found a skill? READ IT COMPLETELY before proceeding
3. Follow the skill's guidance - it prevents known pitfalls

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

This workflow starts every task with browsing ~/.claude/skills/, which creates an unsafe default of enumerating local configuration resources. The risk is elevated by the process-oriented framing because it operationalizes environment discovery as a standard step rather than an exception, increasing exposure to hidden instructions and sensitive metadata.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 121)May include surrounding context.

md

Your workflow for every task:

1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

At L0189-L0195, the document states authors should "Always write in third person" for descriptions. This is a natural-language policy constraint that forces a specific communication style without offering user choice or clearly scoping it as an internal technical requirement, which matches the locale/style policy-violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.