Security audit

Austin

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly static Austin guide, but it asks the agent to persist personal relocation context and modify memory without clear controls.

Review the memory behavior before installing. Only use it if you are comfortable with Austin-related personal context such as budget, role, timeline, and neighborhood preferences being saved locally, and verify legal, tax, housing, school, safety, and current-price guidance from official or professional sources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Hidden Instructions

High

Category: Prompt Injection
Content: integration: pending | done | declined ## Context
Confidence: 83% confidence
Finding: The HTML comments act as hidden operational instructions that shape what the agent should collect about the user, including role, timeline, budget, neighborhoods, and preferences. Hidden collection guidance is risky because it encourages unobvious profiling and persistence of personal context outside a transparent user-visible policy.

Session Persistence

Medium

Category: Rogue Agent
Content: # Memory Template — Austin Create `~/.austin/memory.md` with this structure: ```markdown # Austin Memory
Confidence: 93% confidence
Finding: The instruction to create `~/.austin/memory.md` establishes cross-session persistence of user data in local storage. Without consent, scoping, or lifecycle controls, this can retain personal details across interactions and expose them to unintended reuse or access by other components.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template directs the agent to create and continually update a persistent user memory file, but it provides no user-facing disclosure, consent flow, retention limits, or controls over what personal information is stored. In a skill about relocation and local guidance, this can accumulate sensitive behavioral and lifestyle data over time without the user's awareness.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The neighborhood matrix makes categorical 'Best Areas' and 'Avoid' judgments tied to schools, diversity, nightlife, and community traits without clear sourcing or nuance. In a relocation guidance skill, this can steer users away from specific places in ways that encode bias or proxy discrimination, especially where recommendations intersect with family status, schools, and 'diverse community' framing.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The family-oriented profile advice uses broad exclusionary statements such as avoiding Downtown for 'no space' and Deep East Austin for 'schools,' which can function as overgeneralized steering. Because the skill is explicitly helping people choose where to live, unsupported area exclusions in family/school contexts are more sensitive and can contribute to discriminatory housing guidance.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The Westlake section uses value-laden, exclusionary framing such as 'wealthy enclave,' 'exclusive,' 'old Austin money families,' and 'prestige address,' which can steer users toward or away from areas based on socioeconomic signaling rather than neutral housing factors. In a relocation/neighborhood guidance skill, this is risky because it can normalize discriminatory or biased housing guidance and create policy, compliance, or reputational issues.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger text says the skill should be used when the user asks about 'Texas or Austin,' which is broader than the skill's Austin-focused scope and can cause unintended invocation in unrelated Texas contexts. Over-broad activation increases the chance of unnecessary memory prompts, irrelevant guidance, or skill takeover when another specialized skill should handle the request.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to modify the user's MEMORY.md and only phrases this as a casual question, without clearly disclosing that it is a persistent write to user data. This creates a consent and transparency issue: users may agree without understanding the durability and scope of the stored information, and the agent is being directed to alter long-lived state outside the immediate task.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill directs the agent to accumulate user-specific profile details over time, including profession, budget, transportation access, and neighborhood preferences. Persisting this longitudinal personal data in plain language expands privacy risk, enables profiling beyond the immediate request, and may retain sensitive lifestyle and financial information longer than necessary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The phrase "Bar hopping (one drink max)" normalizes riding scooters after alcohol consumption and does not clearly warn users to avoid riding entirely if they have been drinking. In a travel/transportation skill, users may treat this as practical safety guidance, increasing the risk of injury, legal issues, or harm to others.

Missing User Warnings

Low

Confidence: 97% confidence
Finding: The document gives concrete guidance on business formation, taxes, payroll, worker classification, and licensing without clearly stating that it is not legal, tax, or financial advice. Users may reasonably rely on it as authoritative and make compliance decisions based on incomplete, outdated, or jurisdiction-specific information, increasing risk of legal, tax, or employment mistakes.

Natural-Language Policy Violations

Low

Confidence: 0% confidence
Finding: After reviewing the markdown content, there is no language-forcing instruction, opt-out suppression, or other natural-language organizational policy violation. The file is informational and locale-specific by topic rather than by mandated user language.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The section titled 'Austin Food Rules' tells the user what they must do using commands like 'Eat them', 'Accept this', and 'Participate'. This natural-language framing imposes a behavioral norm rather than presenting optional guidance, which can be read as forcing a specific preference or cultural practice without opt-in.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The statement '"Y'all" is standard vocabulary' prescribes a regional language norm in natural language. Under the locale/language policy, content should avoid forcing or implying a required language style unless it is optional or clearly justified.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The phrase "Pronounced 'Flugerville' — test for newcomers" imposes a pronunciation expectation and frames it as a social test, which can pressure users into conforming to a specific linguistic norm without consent. In a city-guide skill, this is not a technical exploit, but it can reinforce exclusionary or gatekeeping behavior toward newcomers or non-local speakers.

Ssd 3

Low

Confidence: 90% confidence
Finding: The skill asks to record both activation of the skill and a persistent 'integration: declined' state in MEMORY.md. Storing a durable decline marker without strong disclosure is still a persistent write about user preference state, and it may bias future agent behavior based on a one-time response.

Static analysis

No suspicious patterns detected.