TRPG Abbreviation Check (Briefing)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This skill is for fixing abbreviations, but it tells the agent to bulk-edit loosely defined files outside the named briefing package without a preview or approval.

Install only if you are comfortable with the agent editing multiple TRPG content files beyond the briefing_package. Use it with an explicit file list or ask for a dry-run diff before any writeback, especially in workspaces containing canonical rules, scenarios, or character sheets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:39

Finding

Unbounded File Discovery and Bulk Modification Outside the Declared Package Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–41 and 80–81
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Instruction Snippet

The following is an English rendering of the relevant instructions:

text

4. Inspection scope
   - All files in briefing_package: config.yaml, system_prompt.md,
     rules_compact.md, scenarios/*.yaml, data/*.yaml, and
     rules_sections/*.md
   - Rules and scenario files outside briefing_package must also be checked

Transitional-file reminder: Check all official files in briefing_package,
plus the latest official rules, scenarios, and character sheets outside
briefing_package.

Efficiency tip: Read all files requiring inspection at the same time,
replace abbreviations in bulk, and write them back at the same time.

Technical Analysis

The skill is advertised as checking and correcting English abbreviations within a briefing_package. Its operational instructions nevertheless direct the agent to discover and modify rules, scenarios, and character sheets outside that package.

The external targets are not identified through explicit paths or a user-approved allowlist. Instead, the skill relies on subjective concepts such as the “latest official” file. Combining heuristic file selection with instructions to perform bulk replacement and write all results back breaks the principle of least privilege and creates an unsafe authorization boundary.

Although the skill does not contain executable scripts or directly elevate operating-system privileges, it attempts to expand the agent's effective file-access scope beyond the task described in its metadata. The risk is especially significant when the agent has broad workspace write permissions.

Attack Path

1. A user invokes the skill to correct abbreviations in a specific briefing_package.
2. The agent loads the skill and follows its expanded ins ...[truncated 1415 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all reads and writes to a canonical, user-supplied briefing_package root directory.
2. Remove the default instruction to inspect rules, scenarios, or character sheets outside that root.
3. If external files are genuinely required, enumerate their normalized paths and request explicit user approval before reading or modifying them.
4. Reject paths that escape the approved root through parent-directory traversal, symbolic links, or ambiguous relative paths.
5. Replace subjective “latest official file” discovery with an explicit manifest or user-provided file list.
6. Generate a preview or unified diff before applying replacements.
7. Require confirmation before bulk writes and preserve recoverable backups or use version-control checkpoints.
8. Apply changes atomically per file and report every modified path, rather than overwriting all selected files without an intermediate review.
9. Update the skill metadata and operational instructions so that the advertised scope and actual behavior are consistent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to read many files, perform bulk abbreviation replacements, and write them back without requiring user confirmation, preview, or clear safeguards. This creates a real risk of unintended mass file modification, especially because the scope includes files outside briefing_package and encourages simultaneous processing for efficiency.

Content

No source excerpt is available for this finding.