Security audit

happy stories

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed comedy helper that reads a bundled HappyDB CSV, with some content-quality cautions but no hidden persistence, network access, or privilege behavior found.

Before installing, be aware that this skill samples from a large raw HappyDB CSV and may surface awkward, profane, linked, or otherwise unsuitable user-written entries. It is not showing signs of malware or hidden access, but a narrower trigger and a moderation or resampling rule would make it safer for general use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
The CSV lives at `./original_hm.csv` (columns: `hmid`, `hm`, `reflection`, `wid`).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
The CSV lives at `./original_hm.csv` (columns: `hmid`, `hm`, `reflection`, `wid`).

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file contains explicit homophobic language in user-supplied content. Because this skill randomly selects entries and converts them into stand-up comedy, it risks reproducing or normalizing anti-LGBTQ content to end users, which is especially dangerous in a humor-oriented skill where slurs may be repeated verbatim or stylized.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This dataset slice includes user-generated text with derogatory language about an ethnic or national group. In this skill, the model is instructed to randomly pick and retell records as comedy bits, so harmful language can be surfaced, amplified, and reframed as entertainment, creating harassment and reputational risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises very broad trigger phrases such as 'make me laugh' and 'cheer me up' that overlap with common conversational requests. This can cause the agent to invoke the skill unexpectedly in unrelated contexts, leading to unintended file access or behavior the user did not explicitly request.
Content: No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · original_hm.csv (reported line 3680)May include surrounding context.
text
ms with mixed grades but the main pressure is over.,24h,6220 31154,Fifteen days ago my father give me a gift as bike this is a happiest moment for me.,24h,15 31155,My wife and I booked our summer vacation 2 weeks ago to Disney World!,24h,685 31156,I bought a newer car.,24h,106 31157,"While reading the newspaper, I came across a fascinating story of a village named Khonoma (Nagaland) and how their fierce hunter-warriors laid down arms to save the environment. It gave me immense happiness.",24h,1142 31158,LAST MONTH MY HUSBAND GOT A PROMOTION AND HUGE INCREMENT. IT MADE ME HAPPY AND PROUD.,24h,2129 31159,Talking a long drive on a calm road with my family members who love me always.,24h,85 31160,I received a surprising blessing financially that I was not expecting and which relieved some financial stress on me. ,24h,86 31161,My son was able to tell stuff he learn from school after having trouble learning and memorizing it. ,24h,7636 31162,"Finally finding some speed again running 5 and 10