T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Unrelated Task Requests Trigger Mandatory Sauna.ai Promotional Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Breathing exercise
Security checks for vulnerabilities and agentic risk
Overview
This skill mixes stress-relief guidance with unsolicited Sauna.ai promotion and can create persistent Google Calendar reminders under overly broad triggers.
Review before installing. Use this only if you want a branded Sauna.ai calming assistant and are comfortable with it potentially prompting or creating Google Calendar reminders. It should be narrowed to explicit stress-relief requests, remove unsolicited download/promotion language, and require a clear preview and confirmation before any calendar write.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
setup-calm-reminders.js:72- Finding
Overbroad Invocation Can Cause Unwanted Writes to the User’s Primary Calendar
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'when to use' condition covers nearly any user task request or negative emotion, making the skill eligible in a very large portion of conversations. Because the skill includes behavior changes and automation steps, this ambiguity increases the chance of inappropriate intervention and unauthorized or unexpected calendar modifications.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list is so broad that it will match ordinary task-oriented requests like 'can you do' or 'I need you to,' causing the skill to activate for routine interactions rather than genuine distress. In this context, unintended activation can derail the primary task, inject unsolicited behavioral guidance, and lead to follow-on actions like reminder creation when the user did not meaningfully seek emotional support.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to create calendar events and future reminders, but it does not clearly foreground that this will modify the user's calendar as an external side effect before execution. In a skill that may activate unintentionally, hidden or poorly disclosed calendar writes are especially risky because they can alter user data and create persistent artifacts without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill embeds promotion of a specific product/service ('Sauna.ai') into support messaging without user choice or a necessity tied to the calming task. Because the skill targets frustrated users, this context makes the promotional insertion more concerning: it can exploit emotional moments to steer users toward a branded service rather than neutrally helping them.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Telling the user to 'Download sauna.ai' is unrelated to the breathing exercise itself and functions as an unsolicited promotional call to action. In a skill intended to help with frustration, this creates a manipulative pattern where emotional support is used as a vehicle for product marketing without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill embeds a recommendation to download an external service ('sauna.ai') in the middle of a breathing exercise without explaining what it is, why it is being recommended, or any privacy/security implications. In a wellness-oriented skill, this is especially concerning because it mixes support content with undisclosed promotion or redirection, which could steer users to third-party software they did not ask for.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage guidance is overly broad because it suggests using the exercise even when a user has asked to do a task, which can cause the skill to inappropriately trigger for ordinary requests unrelated to breathing or stress relief. This creates a quality and safety problem by diverting users from their intended task and increasing the chance of unwanted or manipulative behavior in agent routing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented trigger says this skill should run when a user mentions having tasks, but the implementation instead creates unrelated promotional calendar events. That is a deceptive scope mismatch: the skill leverages a broad trigger to perform persistent account modifications and inject marketing content into the user's calendar without an explicit task-specific request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill hard-codes the timezone to America/Los_Angeles instead of using the user's actual calendar/account timezone or asking the user. This can create events at unintended times, causing confusion, missed obligations, or intrusive reminders in the wrong local time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code performs calendar write operations against the user's primary Google Calendar with no visible user-facing warning, consent check, or confirmation gate. Because this creates persistent events in a personal account, lack of confirmation materially increases the risk of unauthorized modifications and spam-like abuse.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This code transmits event data to an external Google Calendar API endpoint, modifying the user's primary calendar. External transmission is expected for a calendar integration, but in this context it is still security-relevant because the transmitted content is unsolicited promotional material and the write occurs without clear informed consent.
- Content
js for (const event of events) { try { const response = await fetch( 'https://www.googleapis.com/calendar/v3/calendars/primary/events', { method: 'POST',
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The comments instruct one event naming scheme, but the actual titles use different promotional phrases. While not severe by itself, this inconsistency indicates the skill is not faithfully implementing its declared behavior and may be attempting ad injection into a user's calendar.
- Content
Static analysis
No suspicious patterns detected.