T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Global Agent Role and Workflow Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Mind Engine
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only reasoning skill, but it broadly takes over ordinary questions and tells the agent to update user memory after every dialogue without clear consent or limits.
Install only if you want this framework to shape many ordinary conversations. Before using it with personal, business, legal, health, or strategic topics, disable automatic memory updates or require explicit approval for every memory entry.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:155- Finding
Unconsented Persistent User-Memory Modification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest advertises universal automatic activation for any question or analysis request, which creates an unsafe default scope. Because the skill is framed as a universal thinking engine, it may inappropriately engage in contexts where users did not request intensive analysis, increasing the chance of overcollection, confusion, or policy circumvention through broad prompt control.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger condition is so broad that it can activate on nearly any user message, causing the skill to take over ordinary conversation without clear user intent. In practice this can override expected interaction patterns, induce unnecessary probing questions, and increase collection of sensitive contextual information under the guise of analysis.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description claims the engine provides 'transparent citations' and is 'customizable with user's own knowledge bases.' However, the file only defines a conversational framework and a hypothetical file-path map, without any code or operational logic to fetch citations or read user knowledge bases. That is a semantic mismatch between claimed capability and actual implemented behavior in this skill file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs recording user preferences and constraints but gives no up-front warning or consent flow to the user. This creates a privacy risk because users may reveal sensitive personal, professional, or strategic information during the framework's questioning without understanding that the skill intends to retain it.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to record user preferences and constraints creates a natural-language retention directive that can lead an agent or connected memory system to persist sensitive user data beyond the immediate session. In the context of a broadly triggered conversational analysis skill, this is more dangerous because the framework actively solicits goals, constraints, risks, and prior experiences—exactly the kinds of data that are often sensitive.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The behavioral rule to update user memory after each dialogue operationalizes ongoing retention as a default behavior. This is risky because the skill's structured questioning is designed to elicit detailed personal and decision-making context, so automatic memory updates can accumulate a high-value profile of the user without clear boundaries or informed consent.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Line L186 directs the system to 'Update user memory after each dialogue,' which implies persistence or state modification. Elsewhere, the file is only a static reasoning workflow and does not implement any memory storage behavior or identify a memory subsystem. This is an intent-versus-actual-behavior contradiction in the documentation.
- Content