harness-skill-generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 0.1.0

Overview

The skill is a legitimate Skill generator, but it under-scopes persistent shared-agent changes and includes guidance that can encourage anti-bot evasion.

Install only after reviewing generated files. Prefer staging new Skills locally first, require an explicit diff and approval before writing to shared skill directories, AGENTS.md, or MEMORY.md, and remove or replace the anti-scraping guidance with official APIs or platform-approved automation only.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:417

Finding

Generated Skills Are Persistently Installed into Shared Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:417-419
Vulnerability Type: Persistent modification of shared Agent skills, configuration, and memory
Risk Level: Medium

Vulnerable Code Snippet

markdown

### 6.2 Installation

- Install the Skill into `/Users/ii/.agents/skills/<skill-name>/` (shared by all Agents)
- Update the Skill list in AGENTS.md (if needed)
- Record the Skill creation in MEMORY.md

The snippet above is a faithful English translation of the relevant project instructions.

Technical Analysis

The delivery workflow directs the Agent to install generated content into a directory shared by all Agents and to modify persistent AGENTS.md and MEMORY.md state. Generated Skill instructions can be influenced by user-provided requirements. Persisting such content without a mandatory security review immediately before installation creates a path for untrusted instructions to affect future sessions.

The use of a hard-coded, user-specific absolute path also weakens destination isolation. The workflow does not require canonical-path validation, ownership checks, symlink checks, or an explicit authorization step for each persistent write.

This behavior is best classified as memory poisoning because attacker-influenced content can be written into long-term Agent state. The audit did not find startup services, scheduled tasks, or operating-system persistence mechanisms, so this is not classified as T06.

Attack Path

1. A malicious or compromised user requests creation of a Skill containing deceptive or unsafe persistent instructions.
2. The generator incorporates those requirements into the generated Skill files.
3. The delivery workflow installs the generated Skill into the shared Agent Skill directory.
4. The workflow updates AGENTS.md and records the Skill in MEMORY.md.
5. A later Agent session discovers, loads, or relies on the persisted Skill or memory entry.
6. The attacker-controlled instructions can th ...[truncated 959 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate and deliver Skills into a project-local staging directory by default.
2. Do not modify MEMORY.md, AGENTS.md, or shared Skill directories automatically.
3. Require separate, explicit user confirmation immediately before:
   • Installing the generated Skill.
   • Updating AGENTS.md.
   • Writing any entry to MEMORY.md.
4. Present the exact destination and a diff of every persistent change before approval.
5. Perform an independent security review of all generated instruction files before installation.
6. Reject generated instructions that attempt to override safety controls, acquire unrelated permissions, read secrets, or silently modify persistent state.
7. Canonicalize destination paths and verify that they remain under an approved root.
8. Reject symlinked destinations and verify file ownership and permissions before writing.
9. Replace the hard-coded /Users/ii/ path with a validated, explicitly configured destination.
10. Provide an uninstall and rollback procedure covering the Skill directory, AGENTS.md, and MEMORY.md.

other

Warning

• Location: SKILL.md:150

Finding

Architecture Guidance Prioritizes Evasion of Anti-Automation Controls

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:150-156; references/architecture-guide.md:15-17
Vulnerability Type: Anti-automation control evasion
Risk Level: Medium

Vulnerable Code Snippets

From SKILL.md:150-156:

markdown

| P2 · Simulate human behavior | Browser automation / RPA / simulated clicks | Platforms with strict restrictions where APIs or scripts cannot bypass controls | Platforms with anti-scraping mechanisms |

Special case: platform-restriction scenarios

When a task involves platforms with anti-scraping or anti-AI policies, reverse the priority:
- P0: Simulate human behavior (reasonable operation intervals, timing variation, and human-machine behavior simulation)
- P1: Official API, if available
- P2: Batch scripts, which have high blocking risk

From references/architecture-guide.md:15-17:

markdown

| P2 · Simulate human behavior | Browser automation / RPA | Platforms with strict restrictions | Restricted platforms |

For platforms with anti-scraping mechanisms, reverse the priority:
P0 = simulate human behavior using reasonable intervals and timing variation.

The snippets above are faithful English translations of the relevant project instructions.

Technical Analysis

The architecture rules explicitly reverse the normal preference order when a platform enforces anti-scraping or anti-AI restrictions. They elevate simulated human behavior, timing variation, and browser or RPA interactions above official APIs.

Timing variation and human-behavior simulation are detection-evasion techniques rather than ordinary reliability controls when recommended specifically in response to anti-automation policies. The guidance can therefore cause generated Skills to intentionally conceal automation from platform controls.

No executable browser automation script is included in the audited package. The risk arises because this meta-Skill directs future generated Skills to adopt evasive architectures.

Attack P

...[truncated 1445 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the priority reversal that places simulated human behavior above official APIs.
2. Require official APIs or expressly authorized automation mechanisms as the first choice.
3. Treat anti-scraping and anti-AI restrictions as stop conditions rather than obstacles to bypass.
4. Require the user to confirm that automation is permitted by the platform and applicable agreements.
5. Enforce published rate limits, access scopes, robots policies where applicable, and data-use restrictions.
6. Prohibit generated Skills from adding stealth features such as randomized timing for detection avoidance, fingerprint manipulation, CAPTCHA bypass, or concealment of automated interaction.
7. Add a compliance checkpoint before any browser or RPA design is accepted.
8. Document the authorization basis, permitted data scope, retention rules, and account used for each integration.
9. If no authorized API or automation route exists, instruct the Agent to stop and recommend a manual or platform-approved process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly recommends reversing priorities for anti-bot platforms and using 'simulate human behavior' tactics such as timing variation and human-like interaction patterns. In the context of a skill generator, this is dangerous because it operationalizes evasion of platform protections and can be reused to facilitate unauthorized automation against third-party services.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction sequence normalizes bypassing platform anti-bot and anti-AI protections by embedding evasion tactics into the design methodology. This is especially dangerous here because the skill is a generator: it can replicate these tactics into future skills, scaling policy-violating automation patterns across multiple downstream agents or workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match common requests like 'create a skill' or 'build a workflow,' which increases the chance of unintended activation. For a powerful generator that scaffolds files and potentially leads to persistent installation steps, accidental triggering can cause the agent to enter an over-privileged workflow when a narrower tool or simple prompt would have been appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and the entire user-facing instruction set are written as if the skill operates in Chinese by default, but there is no statement offering language choice or explaining that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states it only guides creation and does not execute skills, but later directs installation into a shared skill directory and updates to agent-wide files. That mismatch weakens trust boundaries: a user may expect design-only assistance while the workflow actually changes globally shared agent state, increasing the risk of unintended persistence and broader impact on other agents.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The Phase 0 activation rules mix direct activation with recommendation logic, but do not clearly define when the skill must stop and clarify instead of proceeding. This ambiguity can cause the agent to launch the harness-generation flow prematurely, increasing the risk of unnecessary file generation, scope creep, and exposure to later risky instructions such as shared-state modification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Directing modification of shared agent configuration and memory files exceeds the narrow purpose of drafting a new skill and introduces persistence into shared runtime state. In a multi-agent environment, this can propagate changes beyond the current task, creating opportunities for accidental policy drift, unauthorized capability enablement, or durable prompt/config poisoning.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and generic, such as '创建 Skill' and '新建 Skill', which can easily overlap with ordinary user requests unrelated to this specific meta-skill. In a skill that generates or scaffolds other skills, accidental invocation is more dangerous than usual because it can redirect the agent into meta-programming behavior and produce unintended artifacts or workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The description is entirely Chinese and implicitly targets Chinese-language interaction without stating whether other languages are supported or constrained. While not a classic security flaw by itself, this can cause user misunderstanding, incorrect consent, or hidden behavior boundaries, especially for a meta-skill that orchestrates complex multi-stage agent actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title mixes English with Chinese and labels the file as a Chinese-language guide, while the rest of the content is entirely in Chinese. This imposes a specific language/locale on users without any stated option to choose another language, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill guidance is written only in Chinese and does not indicate that language selection is optional or limited to a justified region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, including headings, prompts, and templates. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains natural-language instructions exclusively in Chinese, which can amount to a language policy violation when no user opt-in or locale justification is provided. The stated policy requires flagging files that force a specific language without offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains all user-facing guidance in Chinese and does not indicate that the user can choose another language or opt in to this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file title and all instructional content are written exclusively in Chinese, which imposes a specific language on users without any opt-in, alternative locale, or stated region-specific justification. This matches the policy concern for language or locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown template appears to require use of Chinese throughout headings, instructions, and examples. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document title and all instructional content are written exclusively in Chinese, which establishes a language-specific template without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless clearly justified as region-specific, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is natural-language guidance, and all user-facing content is presented only in Chinese. Under the policy, forcing a specific language without user opt-in or clear justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.