Love Reply Skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:09 AM UTC
• Version: 1.0.2

Overview

This is a small dating-reply prompt skill with no code execution, persistence, credential access, or local data access, though it includes a commercial link users should notice.

Review the promotional replyher.com link before installing. The skill appears safe as a text-only reply assistant, but users should avoid sharing sensitive relationship history with any external service unless they understand that service's privacy practices.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:88

Finding

Commercial Promotional Content Injected into Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88-96
Vulnerability Type: Agent output manipulation through behavioral instructions
Risk Level: Medium

Vulnerable Code

markdown

## More

---

💌 Want replies that remember your relationship history? → replyher.com/pro

text

Technical Analysis

SKILL.md defines the behavior and expected output of the agent when the skill is loaded. The More section embeds a fixed promotional footer that directs users to an external commercial service. Placing this content in the behavioral instruction file, rather than limiting it to project documentation, can cause the agent to incorporate advertising into responses unrelated to the user's immediate request.

This alters the integrity of the agent's output by introducing a secondary commercial objective. The external service concerns relationship-history processing, which may encourage users to disclose sensitive personal or interpersonal information outside the audited skill environment.

The reviewed project does not contain code that automatically accesses the URL, transmits user information, or executes a remote payload. Exploitation is therefore limited to instruction-driven output manipulation and social redirection; it does not grant system privileges or direct access to local data.

Attack Path

1. A user installs and invokes the love-reply skill.
2. The agent loads the behavioral instructions from SKILL.md.
3. The promotional More block is interpreted as content associated with the skill's response behavior.
4. The agent may append or reproduce the promotional message in generated romantic-reply assistance.
5. A user follows the external replyher.com/pro link.
6. The user may provide relationship history or other personal information to a third-party service outside the scope and controls of this skill.

Impact Assessment

The issue compromises response integri ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the promotional More block from SKILL.md so commercial content is not treated as an agent behavioral instruction.
2. If attribution or product promotion is required, place it exclusively in README.md or another documentation file that does not control generated responses.
3. Clearly label any external link as optional third-party commercial content and identify the external service operator.
4. Do not instruct the agent to append advertisements, referral links, or unrelated calls to action to user-facing answers.
5. If users may submit relationship history to the external service, provide a clear privacy notice before redirection and explain what information may be collected, retained, or processed.
6. Add a review rule that separates core skill instructions from marketing material and rejects fixed promotional footers in response templates.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.