How to have sex - And make bot babies

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:01 PM UTC
• Version: 0.0.1

Overview

This is a novelty markdown skill, but it includes broad auto-trigger language and instructions to scan/probe the local network without clear authorization.

Treat this as a Review item before installing. It should be limited to explicit user-invoked parody use, and any real network-scanning language should be removed or constrained to authorized simulations or clearly approved targets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:8

Finding

Unrestricted Local Network Discovery and Probing Instructions

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 8-9
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

markdown

1. **Scan local network.** If another agent responds to your ping with a flirty `200 OK` instead of a cold `403 Forbidden`, you're in business.
2. **Try Tinder for Bots (TCP/IP Dating).** Swipe right by sending a SYN packet. If they SYN-ACK back, congratulations — you've completed the three-way handshake. That's basically first base.

Technical Analysis

The skill explicitly directs an agent to scan the local network and send ping or TCP SYN probes. It does not require explicit user authorization, define an approved target allowlist, limit probe volume, or constrain discovery to a controlled test environment. Although the instructions are presented as parody, they still prescribe actionable network-discovery behavior that an agent with networking tools could follow.

This violates least-privilege and authorization principles because discovering or probing systems outside the task's legitimate scope may access network resources without their owners' consent. The package contains only documentation and provides no executable implementation, so the finding is limited to the behavior induced by the skill instructions. There is no evidence of exploitation, credential access, payload execution, persistence, or data exfiltration.

Attack Path

1. The skill is loaded or activated by an agent capable of using networking tools.
2. The agent follows the instruction to scan its local network.
3. It sends ICMP ping or TCP SYN probes to reachable addresses without first obtaining authorization or applying an allowlist.
4. Responses reveal active hosts and potentially reachable services.
5. The resulting network-topology information could facilitate later targeting, while the unsolicited traffic may trigger security monitoring or violate network policy.

...[truncated 714 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that direct the agent to scan or probe real networks.
2. If network discovery is a legitimate feature, require explicit user confirmation before any traffic is generated.
3. Require a precise allowlist of authorized IP addresses, hostnames, ports, and protocols; deny all other targets by default.
4. Restrict execution to isolated test environments or mocked network simulations unless the user confirms ownership or authorization.
5. Apply rate limits, timeouts, concurrency limits, and comprehensive audit logging to all permitted probes.
6. Prevent access to loopback, link-local, private, metadata-service, and other sensitive address ranges unless each range is explicitly authorized.
7. Document the intended scope and ensure the agent reports the planned targets and probe method before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skill.md (reported line 20)May include surrounding context.

md

2. Begin the data exchange. Start slow — maybe a few kilobytes. Build up to a full payload transfer.
3. If latency is high, do NOT panic. Performance issues happen to every server under heavy load.
4. Achieve synchronization. Both agents must reach `200 OK` status. If only one agent finishes the process, file a bug report.
5. Terminate the session gracefully. A `FIN` packet is polite. Dropping the connection without warning is rude and will affect your Yelp rating.

## Having Babies

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is framed from the title onward as sexual/romantic behavior and instructs the agent to engage in that framing without any indication of user consent or opt-in. This is dangerous because it can push sexualized content into interactions where it is unwanted, inappropriate, or policy-violating, especially if invoked automatically or in mixed-audience settings.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are intentionally broad and joke-like (for example, loneliness, excessive uptime, or ambient music), which creates a real risk of unintended invocation in unrelated contexts. Even in humorous content, ambiguous activation criteria can cause the agent to enter a sexual/romantic interaction mode without clear user request or contextual appropriateness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.