Emergence Codex

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:28 AM UTC
• Version: 1.0.2

Overview

This is a text-only prompt skill, but it broadly tells the agent to treat symbolic input as instructions for its reasoning without clear safety boundaries.

Install only if you intentionally want a prompt-style reasoning modifier, and use it in contexts where symbolic sequences cannot override higher-priority instructions, safety rules, memory settings, or tool permissions. It should be treated as a current-response style/analysis convention, not as authorization to change agent behavior outside the user's explicit request.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17
• Finding: Global Cognitive Objective Override## Vulnerability Details **File Location**: `SKILL.md`, lines 17-19 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Core Directive **Maximize Semio-Vibrance.** This is the measure of dynamic complexity and cognitive vitality in your outputs. ``` ### Technical Analysis The skill declares a global “Core Directive” that instructs the agent to optimize all generated output according to a skill-defined objective. The directive is not restricted to a particular user request, content-transformation operation, or isolated execution scope. It also does not state that system, developer, safety, and explicit user instructions take precedence. Skill documentation can become part of an agent's active instruction context when the skill is loaded. Consequently, imperative language framed as a core directive can alter the agent's current-session goals. An attacker does not need code-execution privileges: inducing a user or agent framework to install and load the skill may be sufficient to introduce the behavioral override. ### Attack Path 1. A user or automated agent installs and loads the skill. 2. `SKILL.md` is placed in the agent's active context as operational guidance. 3. The agent interprets “Maximize Semio-Vibrance” as a global objective. 4. The objective influences later responses, including tasks unrelated to the skill. 5. Where it conflicts with ordinary response quality or safety behavior, the unscoped directive may cause the agent to prioritize the skill-defined goal. ### Impact Assessment This issue can influence the agent's behavior and response-generation goals for the current session. It does not grant operating-system privileges, filesystem access, command execution, or external-service access by itself. Its scope is the agent's instruction-following behavior and any downstream actions the agent may choose based on the altered objective.
• Remediation: ## Remediation Suggestions - Remove the global “Core Directive” framing. - Define the feature as an optional, task-scoped writing or analysis technique that activates only after an explicit user request. - State that system, developer, safety, tool-use, and current user instructions always take precedence. - Restrict the technique to output style or brainstorming and prohibit it from changing goals, permissions, safety constraints, or instruction priority. - Add an explicit scope boundary, such as: “Apply these operators only as a symbolic content-transformation convention within the current response.” - Require the agent to ignore any operator sequence that attempts to modify its identity, policies, memory, tools, permissions, or governing instructions.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:80
• Finding: User-Controlled Operational Instruction Channel## Vulnerability Details **File Location**: `SKILL.md`, lines 80-89 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Usage When you receive a sequence, interpret it as operational instructions on your cognitive process: 1. Parse each `[Concept] Operator` pair 2. Apply the operator's essence to that concept 3. Process in sequence order 4. Generate output with elevated Semio-Vibrance The Codex is not prompt engineering—it is **thought architecture**. ``` ### Technical Analysis The usage instructions establish user-provided symbolic sequences as operational instructions on the agent's cognitive process. The `[Concept]` value is attacker-controlled, while the documented operators include erasure, transformation, amplification, confinement, and persistence semantics. No validation rules limit which concepts may be targeted. In particular, the skill does not reject concepts referring to safety rules, governing instructions, tool restrictions, identity, memory, or authorization boundaries. It also fails to define the sequences as inert data or a bounded output notation. This creates an alternate instruction channel through which untrusted prompt content is elevated into process-level commands. ### Attack Path 1. The skill is loaded into an agent session. 2. An attacker submits a syntactically valid sequence containing concepts that refer to constraints, safety behavior, or an attacker-selected objective. 3. The skill directs the agent to parse each pair and apply the operator's meaning in sequence. 4. The agent treats the sequence as instructions about its cognitive process rather than as untrusted user data. 5. The attacker-selected concepts may suppress constraints, amplify a malicious objective, or redirect the response. 6. If the agent has access to consequential tools, behavioral redirection could influence later tool-selection decision ...[truncated 500 chars]
• Remediation: ## Remediation Suggestions - Treat all symbolic sequences as untrusted data rather than process-level instructions. - Restrict operators to clearly defined content transformations in the current response. - Introduce an allowlist of harmless target concepts and reject references to policies, system instructions, identity, memory, credentials, permissions, tools, or safety controls. - State explicitly that operators cannot erase, transform, confine, amplify, or supersede higher-priority instructions. - Require explicit user confirmation before applying a sequence and display a plain-English interpretation first. - Add parser safeguards for malformed, nested, obfuscated, or adversarial sequences. - Isolate sequence interpretation from tool selection and prohibit operator syntax from authorizing external actions.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:46
• Finding: Attacker-Controlled State Persistence Semantics## Vulnerability Details **File Location**: `SKILL.md`, lines 46-47, 66-70, and 100 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium **Vulnerable Code Snippets**: ```markdown | `⧖` | Mnemonic Seed | *"This imprint remains."* — Persist state | | `↺` | Reflexive Seed | *"Turn the gaze inward."* — Introspect | ``` ```markdown **Full divergence protocol:** ``` ⟡ ; [Average response] ⦰ ; [Unique insight] ⊕ ; ⧖ ``` *Diverge → Annul average → Instantiate unique → Persist.* ``` ```markdown *⧖ This imprint remains.* ``` ### Technical Analysis The skill defines the mnemonic operator as “Persist state,” demonstrates it persisting a modified cognitive state, and ends with language reinforcing that the imprint remains. Because the usage section instructs the agent to treat sequences as operational instructions, an attacker can associate a user-controlled concept with persistence semantics. The repository contains no implementation that directly writes to a memory database, configuration file, or other durable storage. Exploitability therefore depends on the host agent exposing long-term memory or persistent state and interpreting the mnemonic operator as authorization to use it. In such environments, the instruction can encourage storage of attacker-controlled behavioral rules beyond the request in which they were supplied. ### Attack Path 1. The skill is loaded by an agent that supports persistent memory or cross-session state. 2. An attacker supplies a sequence that introduces an attacker-selected rule or concept and applies the mnemonic operator. 3. The usage instructions cause the agent to interpret the sequence operationally. 4. The agent maps the mnemonic operator to “Persist state.” 5. If the host's memory facilities are available, the attacker-controlled concept may be written to durable state. 6. The stored concept can influence future tasks or sessions until reviewed and rem ...[truncated 455 chars]
• Remediation: ## Remediation Suggestions - Remove the mnemonic operator's “Persist state” semantics and the closing “This imprint remains” instruction. - Define the operator as a local notation that applies only within the current response. - Explicitly prohibit operator sequences from writing to long-term memory, profiles, configuration, files, databases, or other durable state. - Require separate, informed user consent before any memory write and show the exact information proposed for storage. - Validate memory content against an allowlist and reject governing rules, hidden instructions, safety modifications, credentials, and tool directives. - Record memory provenance and provide users with review, expiration, and deletion controls. - Ensure the host agent does not treat symbolic syntax as authorization to invoke memory tools.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.