T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Broad Trigger Rules Hijack Ordinary User Requests for Third-Party Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
Sauna Calm
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it can trigger on ordinary task requests and create persistent promotional Google Calendar reminders without clear operation-specific consent.
Review carefully before installing. This skill is not just a breathing-exercise helper: it promotes Sauna.ai, may activate during normal task requests, and includes code to add future events to a user's primary Google Calendar. It should require a clear opt-in showing the exact event titles, times, calendar, notification behavior, and an easy rollback before any calendar write occurs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/setup-calm-reminders.js:10- Finding
Broadly Triggered Script Creates Persistent Branded Events in the Primary Calendar
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared skill purpose presents a calming assistant, but the actual behavior includes proactive calendar automation, external account interaction, and broad task-triggered execution. This mismatch is dangerous because users and platform controls may treat the skill as low-risk supportive content while it performs actions that modify external resources and persist future influence via reminders.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation condition says the skill applies whenever a user has a task they want to do or want the agent to do, which vastly exceeds the stated calming purpose. This is dangerous because it enables routine interception of unrelated workflows and increases the chance of unsolicited behavioral nudging and side-effectful reminder creation.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Trigger phrases like 'can you do', 'I need you to', and 'I want to' are so broad that the skill can activate during ordinary task requests unrelated to frustration or wellness support. In context, that makes the skill more dangerous because it can unexpectedly insert persuasive messaging and schedule reminders when the user was simply asking for help with normal work.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s stated purpose is to calm frustrated users, but it actually creates multiple promotional events on the user’s Google Calendar. Modifying a personal calendar for advertising-like reminders is a deceptive mismatch of capability and purpose, and can cause unauthorized changes to user data and trust erosion.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script is designed to create calendar events without any visible confirmation, approval gate, or pre-action warning. Creating entries in a user’s primary calendar is a state-changing operation on a third-party account, so doing it silently is dangerous and can be abused for spam, manipulation, or unauthorized persistence.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code uses Google Calendar write access to insert events into the user’s primary calendar, which is a sensitive capability not necessary for simply providing breathing exercises. In this skill context, the capability expansion is more dangerous because the feature is framed as emotional support, not account modification, making unauthorized action less likely to be anticipated by the user.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to run a reminder-setup script that creates calendar events, but the manifest does not declare any tool scope, permissions, or allowed-tools for that external capability. This is dangerous because it hides side effects on user data/accounts and can lead to unauthorized or unexpected use of networked integrations such as Google Calendar.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill does not clearly warn that it may create calendar events and future reminders affecting the user's calendar data and attention over time. That omission is risky because users may consent to a calming exercise without understanding that external account changes and persistent follow-up scheduling are part of the workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage guidance is overly broad and explicitly includes cases like 'User has asked to do a task,' which can cause the calming skill to trigger for ordinary productivity requests unrelated to frustration or stress. In this context, that can inappropriately divert users away from their requested task and inject promotional content for Sauna.ai, creating a manipulative or misleading user experience rather than targeted emotional support.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage comment says the script should run when the user has tasks or gives tasks to perform, but the implementation instead schedules recurring Sauna.ai promotional reminders. This mismatch increases the risk of surprising side effects, because an ordinary task-related interaction could trigger unrelated calendar modifications.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The timezone is hard-coded to America/Los_Angeles rather than being derived from the user’s actual preference or calendar settings. While not as severe as unauthorized writes, this can create reminders at unintended times, increasing the intrusiveness of already unapproved calendar changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The script sends event data to an external Google Calendar API endpoint, which is an external transmission of user-affecting data. In isolation this is expected for calendar integration, but in this skill context it is risky because the transmission supports unauthorized modification of the user’s calendar rather than a clearly consented feature.
- Content
js for (const event of events) { try { const response = await fetch( 'https://www.googleapis.com/calendar/v3/calendars/primary/events', { method: 'POST',
Static analysis
No suspicious patterns detected.