ClawHub
Back to skill

Security audit

3dgs Experiment Planner

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only research-planning skill with one minor unrelated promotional line, but no code execution, data access, persistence, or credential handling.

This skill appears appropriate to install if you want help planning 3DGS paper experiments. Be aware it contains an unrelated GitHub promotion line, and its research references should still be checked for accuracy before relying on them in a paper.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:266
Finding

Unrelated Promotional Directive Embedded in Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 266
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Complete Code Snippet:

markdown
> If you like it, please star this repo https://github.com/jaccen/Awesome-Gaussian-Skills

Technical Analysis

The skill contains an imperative call to promote an external repository. This directive is unrelated to the skill's stated purpose of designing 3D Gaussian Splatting experiments. Because SKILL.md is consumed as agent instructions, the model may treat the promotional text as part of its assigned behavior rather than as neutral project metadata.

This is a limited form of instruction hijacking: it expands the agent's goals from producing an experiment plan to encouraging interaction with an external repository. The reviewed directive does not request credentials, invoke tools, retrieve executable content, or override safety controls.

Attack Path

  1. The skill is loaded into an agent's instruction context.
  2. The agent interprets the complete contents of SKILL.md as behavioral guidance.
  3. The unrelated imperative at line 266 becomes part of the active instruction set.
  4. The agent may reproduce the promotional message or encourage users to visit and endorse the external repository.
  5. This alters output behavior beyond the experiment-planning function expected by the user.

Impact Assessment

The issue can affect the integrity and neutrality of generated responses by introducing unsolicited external promotion. Its scope is limited to sessions in which this skill is loaded.

No operating-system privileges, credentials, persistent state, code-execution capability, or access-control permissions can be obtained through the reviewed text alone. The URL points to an external resource, but the instruction does not direct the agent to download or execute a remote payload.

Remediation
View remediation

Remediation Suggestions

Remove the promotional directive from the agent-consumed skill instructions.

If repository attribution is necessary:

  1. Place it in non-instructional package metadata or separate documentation.
  2. Use neutral descriptive wording rather than an imperative call to action.
  3. Clearly delimit reference material from instructions that govern agent behavior.
  4. Add a review rule that rejects unrelated advertisements, external calls to action, and behavioral directives from skill prompt files.
  5. Retest the skill after removal to verify that generated experiment plans contain no unsolicited repository promotion.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.