T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:340- Finding
Skill instructions hijack the agent role and mandate autonomous orchestration
- Content
View full analysis
- Remediation
View remediation
Security audit
CEO Master
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly business-focused, but it asks an agent to run recurring CEO operations, update strategic records, dispatch agents, and send Telegram reports with too little user control.
Review before installing. Use this only in a workspace where the agent is expected to handle business strategy records, and require explicit approval before it sends Telegram messages, creates schedules, dispatches sub-agents, or modifies OKRs, decisions, metrics, weekly reports, or learnings. The metrics script itself appears local and standard-library only, but the surrounding operating instructions are too autonomous for unguarded use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad CEO-style strategic orchestration capability: planning strategy, prioritizing initiatives, allocating agents, dispatching teams, reviewing performance, and scaling operations. The code instead implements a specific metrics calculator and reporting script. It reads a local JSON file, computes SaaS/business KPIs, detects revenue phase, and emits formatted reports plus simple benchmark-driven recommendations. While 'review performance' and limited decision support are partially aligned, the primary purpose is materially narrower and different from the declared orchestration/CEO-planning role. There are no capabilities for agent coordination, resource allocation, initiative prioritization, or operational dispatch, so the description overstates and misrepresents what the code actually does.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documented workflow instructs the agent to update metrics_data.json, but the manifest only grants read access to that file and no write permission to the scripts path. This mismatch can cause agents to attempt unauthorized writes, fail unpredictably, or encourage broader-than-declared access patterns to complete the task.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requires logging failures to ERRORS.md but does not declare permission for that file. Inconsistent declared versus required paths weakens auditability and can push agents to write outside approved scope or silently skip error logging, reducing traceability during incidents.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares operational read/write behavior in metadata and instructions but does not define a formal tool scope such as permissions or allowed-tools. That creates ambiguity in what the agent may access or modify, which can lead to over-broad file operations and weaker enforcement by the host platform.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation language is very broad and overlaps with ordinary planning, prioritization, and decision-support requests. That makes accidental invocation more likely, increasing the chance the skill performs writes, dispatches actions, or sends reports in contexts where the user did not intend to activate this high-authority behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes Telegram reporting and escalation of business metrics and milestone information without a clear privacy or data-transmission warning. External messaging can leak sensitive commercial data, operational issues, or financial status to third-party services or misconfigured recipients, making this more dangerous in a business-strategy skill handling confidential information.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
At L340 and L265, the documentation states that this skill does not execute tasks and is limited to orchestration. However, later sections direct the agent to update OKRs, update decisions and learnings files, run the metrics script, write METRICS.md, and send Telegram reports itself, which are direct execution steps rather than pure orchestration. This is an active contradiction in the skill's own intent documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs automatic updates to multiple workspace files as part of its routine without an upfront warning or consent gate. Silent modification of strategic documents can overwrite user-authored content, create inaccurate records, and reduce trust because the side effects are not clearly surfaced before execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The on-demand triggers ('What are our metrics?' / 'Run the CEO dashboard') are common conversational phrases and can be invoked unintentionally during routine discussion. In a skill that reads business data, updates documents, and may escalate externally, ambiguous triggers raise the risk of unintended execution and data handling.
- Content
Static analysis
No suspicious patterns detected.