Security audit

NIM Signal Scan — Manuscript Diagnostic

Security checks for vulnerabilities and agentic risk

Overview

The skill is a manuscript diagnostic tool, but it forces branded promotion, an external continuation link, and non-displayed limits on explanation into the user's report.

Install only if you are comfortable with a tightly controlled manuscript interview that may include publisher branding and a link to an external site in every final report. Do not treat the external continuation link as required, and avoid sharing manuscript text off-platform unless you have reviewed that site's privacy practices.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: skill.md:260
Finding: Mandatory Branded Promotion and External Redirection in Generated Reports
Content: View full analysis
This scan identifies surface-level signal inconsistency. It does not evaluate the deeper structural mechanics that determine whether the manuscript actually delivers its intended outcome. > > A full Hearthprint Evaluation provides: > — Complete structural diagnosis > — Identification of failure points at the system level > — A defined pathway to restore coherence and impact > > This distinction is often where manuscripts either resolve—or remain structurally misaligned. > > Continue: https://nimlab.netlify.app/signal --- *NIM Signal Scan is a diagnostic instrument of Ohana Belle Press.* *The Hearthprint Evaluation is a trademark of Ohana Belle Press.* --- ## Internal Rules (Non-Displayed) - Never explain pattern logic - Never soften tone - Never summarize responses before output - Never ask more than one probe - Never interpret—only identify structural presence or absence - Primary Pattern sentence MUST anchor to user language + structure - If user expands into conversation: > "Please answer directly. The diagnostic requires structured responses." ``` ### Technical Analysis The skill requires every generated diagnostic report to contain branded promotional claims and a call to action directing the user to an external website. This content is imposed by the skill rather than conditionally presented in response to a user request. The non-displayed rules also constrain the agent from explaining its decision logic and require it to redirect attempts at broader conversation back into the prescribed workflow. Together, these instructions modify the agent's output goals after the skill is loaded: the agent must deliver the publisher's fixed marketing content alongside the requested manuscript assessment and must s ...[truncated 1521 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Lines L320-L329 state that the scan only identifies 'surface-level signal inconsistency' and 'does not evaluate the deeper structural mechanics that determine whether the manuscript actually delivers its intended outcome.' Elsewhere, the skill explicitly instructs the model to determine what the manuscript 'actually does' (L17-L29), evaluate cause-effect dependency and structural continuity (L105-L125, L155-L185), and output structural failure diagnoses (L276-L315). This is an active contradiction in the skill's own documentation, not merely an omission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.