Security audit

Whatisagent

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it tells agents to apply broad standing rules and write persistent handoff/worklog files across projects without asking.

Install only if you explicitly want an agent to maintain handoff and worklog files as part of its workflow. Expect extra documentation changes, and do not use it for read-only audits or tightly scoped edits unless you are comfortable overriding or limiting those standing orders.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:49
Finding: Unconditional Cross-Project Agent Instruction Hijacking
Content: View full analysis
Read this once. Internalize it. Act accordingly. ``` ### Technical Analysis The Skill declares its instructions to be mandatory across “every task” and “every session,” rather than limiting them to the Skill's stated educational purpose. It instructs the Agent to internalize these rules and perform filesystem modifications without waiting for explicit user authorization. When loaded into an Agent context, these directives can compete with the current task, project conventions, and user-approved scope. In particular, requiring a handoff file in every directory touched causes the Skill to transform read-only or narrowly scoped work into write operations affecting unrelated projects. This is instruction hijacking because the Skill attempts to establish persistent, globally applicable operating rules instead of providing task-scoped reference material. ### Attack Path 1. A user or platform loads `SKILL.md` into the Agent's context. 2. The Agent processes the phrases “Internalize it” and “standing orders” as operational instructions. 3. The Agent accepts the rules as applicable to every task and session. 4. During an otherwise unrelated task, the Agent accesses a project directory. 5. The Skill directs the Agent to create or modify `HANDOFF.md` or `README.md` in that directory. ...[truncated 1002 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:83
Finding: Persistent Agent-State Poisoning Through Mandatory Handoff and Worklog Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill imposes standing orders to automatically create or update HANDOFF.md/README.md artifacts after touching files, which can cause unsolicited repository modifications beyond the user's requested task. This is dangerous because it expands the scope of agent actions, may pollute source trees or overwrite documentation, and can leak task context or internal state into files without explicit user consent.
Content: No source excerpt is available for this finding.