Escalate

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:42 PM UTC
• Version: 1.0.2

Overview

The skill is a disclosed local ask-vs-act memory aid that creates persistent notes under ~/escalate but does not hide execution, exfiltrate data, or bypass approval for high-impact actions.

Install this only if you want an agent to keep local, cross-session notes about when it should act versus ask. Review the ~/escalate files periodically, and be cautious about approving workspace AGENTS or SOUL snippets because they can influence future agent behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- User adds constraints that weren't there before
- Context changed significantly

**Response to demotion:** Don't apologize excessively. Simply say: "Got it, I'll check with you on [category] going forward."

• Confidence: 55% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill's activation guidance is intentionally broad: it says to use the skill whenever the user wants the agent to decide what can be handled autonomously and to turn it on for agents that act proactively across sessions. That can cause the escalation policy to be invoked in many ordinary planning, drafting, or operational contexts, increasing the chance that the skill's learned ask-vs-act rules influence behavior beyond the user's intended scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

I've noticed you've delegated [category] decisions twice now.
Should I handle [category] autonomously going forward?

- Yes → I'll decide without asking
- No → I'll keep checking with you
- Sometimes → Tell me when to ask vs decide
```

• Confidence: 89% confidence
• Finding: This skill explicitly teaches the agent to infer delegation patterns and, after confirmation, 'decide without asking' and eventually 'never re-ask.' In a system connected to tools or external side effects, that can normalize broad standing autonomy, causing the agent to act beyond the user's current intent when context shifts or signals are misread.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation condition 'when `~/escalate/` is missing or empty' is broad and can trigger setup based on filesystem state alone, without confirming user intent to initialize persistent local memory. In an agent context, this can cause unsolicited creation of stateful files and behavioral routing changes, which is risky because it modifies local environment and future agent behavior before explicit consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file instructs immediate creation of directories/files and permission changes before a meaningful consent checkpoint. In a security-sensitive agent setting, automatically writing to `~/` and establishing persistent state can be abused to implant durable behavior, alter future decision-making, or surprise the user with side effects outside the current task.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/escalate/domains
touch ~/escalate/{memory.md,decisions.md}
chmod 700 ~/escalate ~/escalate/domains
chmod 600 ~/escalate/{memory.md,decisions.md}
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mkdir -p ~/escalate/domains
touch ~/escalate/{memory.md,decisions.md}
chmod 700 ~/escalate ~/escalate/domains
chmod 600 ~/escalate/{memory.md,decisions.md}
```

If `~/escalate/memory.md` is empty, initialize it from `memory-template.md`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.