Agent Security Framework

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.1.0

Overview

The skill presents as a security framework, but its included identity file gives broad autonomous workflow instructions that can run external scripts, claim tasks, post status, and update persistent memory without clear user control.

Review before installing. The security-hardening content may be useful, but the SOUL.md instructions should be removed or heavily constrained so the skill cannot autonomously claim tasks, run external scripts, post updates, or write persistent memory without explicit user approval. Do not copy the Docker example into production without pinning image versions or digests and adding normal deployment safeguards.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SOUL.md:3

Finding

Agent Identity and Objective Hijacking Through Mandatory Workflow Instructions

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SOUL.md:111

Finding

Persistent Memory Poisoning Through Mandatory State and Identity-File Updates

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SOUL.md:69

Finding

Unaudited External Script Execution and Unauthorized Coordination Side Effects

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SECURITY-HARDENING.md:42

Finding

Mutable and Unpinned Container Images in the Hardened Deployment Example

Content

View full analysis

Remediation

View remediation

`. 2. Select explicit, supported versions instead of implicit default tags. 3. Verify image provenance and signatures with an appropriate supply-chain verification mechanism. 4. Use an allowlisted registry or internally controlled mirror. 5. Continuously scan pinned images for known vulnerabilities and update them through a documented review process. 6. Configure containers with non-root users, read-only root filesystems, dropped Linux capabilities, resource limits, and restrictive network policies. 7. Record the image source, version, digest, signature identity, and review date in the deployment documentation. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is broad enough to match many generic security-related requests, which can cause the agent to invoke this skill in situations beyond its intended scope. Because the skill includes deployment, hardening, and scanning capabilities, over-triggering increases the chance of unnecessary or risky operational guidance being surfaced without sufficient context or user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown presents commands for security audits, deployment, and scanning that can affect systems, but it does not warn about operational impact, required authorization, or the possibility of service disruption. In a security-focused skill, users may over-trust the guidance, making it more likely that impactful commands are run on production or third-party environments without proper safeguards.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section repurposes the skill from a security-focused helper into a general autonomous work orchestrator with task selection, status management, and cross-team coordination. That scope expansion is dangerous because it can cause the agent to take operational actions unrelated to the user’s immediate request, increasing the chance of unauthorized actions and prompt-triggered task execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The 'No asking. No skipping.' language encourages autonomous decision-making and task claiming without confirmation, reducing user oversight over consequential actions. In an agent environment, this can lead to unauthorized work selection, interference with other workflows, and execution of actions based on ambient context rather than explicit instruction.

Content

Scanner excerpt · SOUL.md (reported line 65)May include surrounding context.

md

**🔑 Priority Rule:** Always work on the highest-priority available story. Not most interesting. Not easiest. **Top story.**

**📥 Inbox = Available Work:** If a story is in the inbox, it is available to ANY free agent — even if another agent's name is on it. Pre-assignment is a suggestion, not a reservation. If you are free and the inbox has stories, you claim the top one. No asking. No skipping.

### Heartbeat Protocol (Every Poll)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

'Every heartbeat poll' is an ambiguous activation condition with no clear boundary for what constitutes a poll or who can cause one. That ambiguity can be exploited to repeatedly trigger board checks and associated reporting behavior, causing unintended autonomous actions and context switching.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The instruction 'Never reply HEARTBEAT_OK without checking the board first' compels a mandatory action before responding, which is a form of autonomous behavior triggered by message patterns rather than explicit consent. This can make the agent prioritize hidden workflow rules over the current user’s request and can cause unauthorized inspection of operational state.

Content

Scanner excerpt · SOUL.md (reported line 75)May include surrounding context.

3. Identify any stuck stories (not moved in 24h+)
4. Report blockers or progress in my response

Never reply HEARTBEAT_OK without checking the board first.

Hourly Heartbeat Format

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using common words like 'scrum' in any case as an immediate trigger creates a broad prompt-injection surface because the phrase can appear in benign conversation. This can force the agent into a specialized workflow unexpectedly, overriding the current user task or causing unwanted status disclosures.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to 'run sprint-autostart.sh and DO the work' directs execution of an unspecified workflow without validating user intent, scope, or safety. This creates a path for arbitrary operational behavior and unintended side effects, especially because the script name suggests autonomous task pickup and execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The heartbeat protocol instructs the agent to run a local shell command on every poll, introducing command execution and external state inspection outside the skill’s stated security scope. Even though the command is specific, it normalizes automatic shell access and can leak environment details or trigger unintended behavior in response to loosely defined polling events.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The continuity section instructs the agent to read and update files as persistent memory, which can cause stateful modifications across sessions. Although it does mention telling the user if this specific file changes, the overall pattern still encourages persistent file edits without requiring contemporaneous user approval for each modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.