ia-md-docs

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 2:23 PM UTC
• Version: 5.1.1

Overview

This skill is a documentation helper that reads project files and updates Markdown documentation with disclosed safeguards.

Review generated changes before accepting them, especially AGENTS.md or CLAUDE.md because those files can affect future agent behavior. The skill is otherwise coherent for documentation maintenance and does not show hidden execution, credential handling, exfiltration, or destructive behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md

Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SPEC.md (reported line 29)May include surrounding context.

md

- Should not trigger for (from fixture should_not_trigger):
  - "fix the flaky integration test for payments"
  - "add Redis caching to the product listing"
  - "rewrite this skill's SKILL.md body"

## Source And Evidence Model

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/init-agents.md (reported line 32)May include surrounding context.

md

Native loading differs from a symlink or import in two places: `InstructionsLoaded` hooks do not fire for a natively read AGENTS.md (they do fire through a CLAUDE.md symlink or `@AGENTS.md` import), and directories added with `--add-dir` while `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` is set load their CLAUDE.md but not their AGENTS.md. Keep the symlink when either matters.

Use `ln -s`, not `ln -sf`: `-f` replaces a real CLAUDE.md without warning.

## Modes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- Preserve request authority, external-action boundaries, proof standards, and failure-attribution rules when condensing context.
- Do not create CONTRIBUTING.md or DOCS.md as a side effect; apply the specific workflow's creation limits.
- Keep cross-cutting conventions discoverable in the main context file and avoid duplicated volatile facts.
- Report actual edits and checks; do not claim snippets or external identifiers verified without checking them.

## Portability

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 75% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/context-content-and-writing.md (reported line 9)May include surrounding context.

md

- **Installed skills, plugins, or extensions**: these change with the user's environment, not the project; the list rots within weeks.
- **Tool versions outside the project's source of truth**: `package.json` engines, `.nvmrc`, `pyproject.toml` Python constraint, `composer.json` PHP version. List the source-of-truth file path; do not duplicate the version inline.
- **Linter / formatter rule restatements**: if `.eslintrc`, `ruff.toml`, `phpcs.xml` already enforce it, the file is the spec. List the command to run; do not paraphrase rules.
- **README content**: if information is already in README.md (install, badges, intro), reference it; do not re-paste.

The test: if a fact will be wrong in two months without anyone touching this file, it does not belong here.

Static analysis

No suspicious patterns detected.