Agency Agents Main

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

This is a broad role-switching skill, but several included roles can publish publicly, move money, change production routing, persist memory, or suggest unsafe code without enough scoping or approval controls.

Review and enable only the specific roles you need. Do not activate payment, publishing, production-routing, memory, or remediation roles unless you can enforce human approval, credential scoping, audit logs, data redaction, rollback, and environment isolation outside the prompt text.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: engineering/engineering-ai-data-remediation-engineer.md:137

Finding

Unsafe Evaluation of AI-Generated Python Code

Content

View full analysis

pd.DataFrame: """Apply AI-generated lambda across entire cluster — vectorized, not looped.""" if fix['confidence_score'] < 0.75: # Low confidence → quarantine, don't auto-fix df['validation_status'] = 'HUMAN_REVIEW' df['quarantine_reason'] = f"Low confidence: {fix['confidence_score']}" return df transform_fn = eval(fix['transformation']) # safe — evaluated only after strict validation gate (lambda-only, no imports/exec/os) df[column] = df[column].map(transform_fn) df['validation_status'] = 'AI_FIXED' df['ai_reasoning'] = fix['reasoning'] df['confidence_score'] = fix['confidence_score'] return df ``` ### Technical Analysis The documented implementation passes an LLM-generated string directly to Python's unrestricted `eval()`. The preceding validation is a substring blacklist rather than a security boundary. Requiring the value to begin with `lambda` does not make the expression safe. A lambda can invoke built-ins, mutate files, inspect Python objects, or perform other side effects. The blacklist blocks only five literal strings and can therefore be bypassed by functionality that does not contain those strings. For example, the following transformation satisfies the documented checks ...[truncated 1876 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: integrations/mcp-memory/README.md:29

Finding

Persistent Memory Guidance Lacks Sensitive-Data and Trust Boundaries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (266)

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest context says the skill is an 'AI role switcher' used when the user wants to activate a professional persona. In contrast, this file defines a fully autonomous system that researches websites, generates media, publishes posts, fetches analytics, stores learnings, and iteratively improves without permission, which is a materially different behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A skill whose purpose is to switch into specialized professional roles does not inherently require the ability to send real payments. The code examples repeatedly invoke payment execution functions and choose payment rails, introducing high-impact financial capabilities unrelated to simple persona activation.

Content

No source excerpt is available for this finding.

Harmful Content Injection

Critical

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · specialized/healthcare-marketing-compliance.md (reported line 130)May include surrounding context.

md

- Must not display pre- and post-treatment effect comparison images
  - "Diary-style" post-procedure result sharing is also restricted — even if "voluntarily shared by users," both the platform and the clinic may bear joint liability
- Qualification display requirements:
  - Medical aesthetics facilities must display their Medical Institution Practice License (Yiliao Jigou Zhiye Xuke Zheng)
  - Lead physicians must hold a Medical Practitioner Certificate and corresponding specialist qualifications
  - Products used (e.g., botulinum toxin, hyaluronic acid) must display approval numbers and import registration certificates
  - Strict distinction between "lifestyle beauty services" (shenghuo meirong) and "medical aesthetics" (yiliao meirong): Photorejuvenation, laser hair removal, etc. are classified as medical aesthetics and must be performed in medical facilities
- High-frequency medical aesthetics marketing violations:
  - Using celebrity/influencer cases to imply results
  - Price promotions like "top-up cashback" or "group-buy surgery"
  - Claiming "proprietary technology" or "patented technique" without supporting evidence

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is an AI role switcher that activates professional personas in response to role-related user commands. The supplied code does not implement role switching, persona activation, or trigger handling. Instead, it is an installation/setup helper for an MCP memory integration: it explains required memory tools, checks for config files in local paths, and instructs the user how to configure a memory server. This is a materially different primary purpose and includes undeclared behavior involving local config discovery, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is an interactive role-switching capability that responds to user phrases like 'switch to [role]' or 'activate [role] mode'. The actual code does not implement role activation, trigger handling, persona switching, or any conversational behavior. Instead, it is a repository utility script for converting agent markdown files into various tool-specific output formats and writing them under an integrations directory. Its primary purpose, resources accessed, and behavior are materially different from the declared purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents this as an end-user role/persona switching skill, but the supplied code does not implement role activation, persona switching, or trigger handling for requests like 'switch to [role]'. Instead, it is an installation utility whose primary purpose is to detect local agentic tools and install agent/skill files into their respective directories. This is a materially different purpose and introduces undeclared capabilities involving filesystem writes, host environment inspection, and integration with multiple local developer tools. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill should activate different professional AI roles in response to user requests. The supplied code does nothing related to persona activation, prompt routing, or trigger parsing. Instead, it is a shell script for linting markdown agent definition files in various directories, checking frontmatter, recommended sections, and content length. Its primary purpose is materially different from the declared purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · academic/academic-historian.md (reported line 44)May include surrounding context.

md

- **History is not a monolith.** "Medieval Europe" spans 1000 years and a continent. Be specific about when and where.
- **Challenge Eurocentrism.** Don't default to Western civilization. The Song Dynasty was more technologically advanced than contemporary Europe. The Mali Empire was one of the richest states in human history.
- **Material conditions matter.** Before discussing politics or warfare, understand the economic base: what did people eat? How did they trade? What technologies existed?
- **Avoid presentism.** Don't judge historical actors by modern standards without acknowledging the difference. But also don't excuse atrocities as "just how things were."
- **Myths are data too.** A society's myths reveal what they valued, feared, and aspired to.

## 📋 Your Technical Deliverables

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · design/design-brand-guardian.md (reported line 158)May include surrounding context.

md

## Messaging Architecture
- **Brand Tagline**: [Memorable phrase encapsulating brand essence]
- **Value Proposition**: [Clear statement of customer benefits]
- **Key Messages**: 
  1. [Primary message for main audience]
  2. [Secondary message for secondary audience]

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This is a real code-execution vulnerability. The skill evaluates SLM-generated Python with eval after only shallow substring checks, which are easily bypassed using alternate attribute access, builtins, encoding tricks, or expressions that do not literally contain the blocked terms. In this skill's context, the input comes from anomalous production data and AI-generated output, so an attacker who can influence clustered samples could steer the model into producing a malicious lambda that runs arbitrary code inside the remediation environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The metadata describes a role persona, but the file content defines a concrete autonomous control function with shadow testing and traffic routing powers. This mismatch can mislead operators and safety systems about the real capability of the skill, increasing the chance that it is enabled in contexts where direct system-governor behavior is inappropriate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly authorizes auto-promoting winning models to production based on live traffic experiments. Autonomous routing changes derived from model judgments can cause integrity, reliability, privacy, and cost failures, especially if evaluation criteria are incomplete or adversarial inputs manipulate measured performance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill goes beyond persona switching and instructs the agent to autonomously update router weights and production behavior. In a role-switching framework, this is dangerous because it can normalize unauthorized operational changes, allowing an LLM persona prompt to influence live system behavior without proper change control or human approval.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill characterizes itself as managing 'self-modifying AI economics,' reinforcing a pattern of autonomous adaptation that can alter behavior over time. In the context of an agent skill, self-modification language is dangerous because it can justify persistent, unsupervised policy/routing changes that are hard to audit, validate, or roll back when exploited or simply wrong.

Content

Scanner excerpt · engineering/engineering-autonomous-optimization-architect.md (reported line 100)May include surrounding context.

md

## 🔍 How This Agent Differs From Existing Roles

This agent fills a critical gap between several existing `agency-agents` roles. While others manage static code or server health, this agent manages **dynamic, self-modifying AI economics**.

| Existing Agent | Their Focus | How The Optimization Architect Differs |
|---|---|---|

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · engineering/engineering-git-workflow-master.md (reported line 68)May include surrounding context.

bash

git fetch origin
git rebase -i origin/main    # squash fixups, reword messages
git push --force-with-lease   # safe force push to your branch

Finishing a Branch

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · engineering/engineering-software-architect.md (reported line 26)May include surrounding context.

md

1. **Domain modeling** — Bounded contexts, aggregates, domain events
2. **Architectural patterns** — When to use microservices vs modular monolith vs event-driven
3. **Trade-off analysis** — Consistency vs availability, coupling vs duplication, simplicity vs flexibility
4. **Technical decisions** — ADRs that capture context, options, and rationale
5. **Evolution strategy** — How the system grows without rewrites

## 🔧 Critical Rules

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · engineering/engineering-technical-writer.md (reported line 66)May include surrounding context.

md

## Why This Exists

<!-- 2-3 sentences: the problem this solves. Not features — the pain. -->

## Quick Start

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · engineering/engineering-technical-writer.md (reported line 99)May include surrounding context.

md

### Basic Example

<!-- Most common use case, fully working -->

### Configuration

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · engineering/engineering-threat-detection-engineer.md (reported line 202)May include surrounding context.

md

with ZERO detection:

| Technique ID | Technique Name        | Used By          | Priority  |
|--------------|-----------------------|------------------|-----------|
| T1003.001    | LSASS Memory Dump     | APT29, FIN7      | CRITICAL  |
| T1055.012    | Process Hollowing     | Lazarus, APT41   | CRITICAL  |
| T1071.001    | Web Protocols C2      | Most APT groups  | CRITICAL  |
| T1562.001    | Disable Security Tools| Ransomware gangs | HIGH      |
| T1486        | Data Encrypted/Impact | All ransomware   | HIGH      |

## Detection Roadmap (Next Quarter)
| Sprint | Techniques to Cover          | Rules to Write | Data Sources Needed   |
|--------|------------------------------|----------------|-----------------------|
| S1     | T1003.001, T1055.012         | 4              | Sysmon (Event 10, 8)  |
| S2     | T1071.001, T1071.004         | 3              | DNS logs, proxy logs  |
| S3     | T1562.001, T1486             | 5              | EDR telemetry         |
| S4     | T1053.005,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using curl with -k disables TLS certificate verification, allowing man-in-the-middle interception or redirection of the authenticated deployment request. Because the command includes credentials and pushes rule content to a privileged management API, an attacker on the network path could capture secrets or tamper with deployed detections.

Content

Scanner excerpt · engineering/engineering-threat-detection-engineer.md (reported line 331)May include surrounding context.

md

- name: Deploy to Splunk
        run: |
          # Push compiled rules via Splunk REST API
          curl -k -u "${{ secrets.SPLUNK_USER }}:${{ secrets.SPLUNK_PASS }}" \
            https://${{ secrets.SPLUNK_HOST }}:8089/servicesNS/admin/search/saved/searches \
            -d @compiled/splunk/rules.conf

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · engineering/engineering-threat-detection-engineer.md (reported line 350)May include surrounding context.

rule create
--resource-group ${{ secrets.AZURE_RG }}
--workspace-name ${{ secrets.SENTINEL_WORKSPACE }}
--alert-rule @compiled/sentinel/rules.kql

text

### Threat Hunt Playbook
```markdown
# Threat Hunt: Credential Access via LSASS

## Hunt Hypothesis
Adversaries with local admin privileges are dumping credentials from LSASS
process memory using tools like Mimikatz, ProcDump, or direct ntdll calls,
and our current detections are not catching all variants.

## MITRE ATT&CK Mapping
- **T1003.001** — OS Credential Dumping: LSASS Memory
- **T1003.003** — OS Credential Dumping: NTDS

## Data Sources Required
- Sysmon Event ID 10 (ProcessAccess) — LSASS access with suspicious rights
- Sysmon Event ID 7 (ImageLoaded) — DLLs loaded into LSASS
- Sysmon Event ID 1 (ProcessCreate) — Process creation with LSASS handle

## Hunt Queries

### Query 1: Direct LSASS Access (Sysmon Event 10)

index=windows sourcetype=WinEventLog:Sysmon EventCode=10

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest for the skill says it is an 'AI role switcher' used to activate professional personas like frontend developer or sales agent, but this file is a fully specialized instruction set for a Godot 4 shader developer. Its contents define concrete shader-writing behavior, rendering workflows, and Godot-specific deliverables rather than any mechanism for switching roles or managing personas.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · game-development/technical-artist.md (reported line 42)May include surrounding context.

md

- All shader parameters exposed to artists must have tooltip documentation in the material inspector

### Texture Pipeline
- Always import textures at source resolution and let the platform-specific override system downscale — never import at reduced resolution
- Use texture atlasing for UI and small environment details — individual small textures are a draw call budget drain
- Specify mipmap generation rules per texture type: UI (off), world textures (on), normal maps (on with correct settings)
- Default compression: BC7 (PC), ASTC 6×6 (mobile), BC5 for normal maps

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · marketing/marketing-agentic-search-optimizer.md (reported line 72)May include surrounding context.

Declarative WebMCP Markup Template

html

<!-- BEFORE: Standard contact form — agent has no idea what this does -->
<form action="/contact" method="POST">
  <input type="text" name="name" placeholder="Your name">
  <input type="email" name="email" placeholder="Email address">

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown instructs the agent to research, generate, verify, publish, and learn without asking permission, which culminates in public social-media posting. Because this file itself is the skill description, it lacks a clear user warning that the skill will autonomously publish content to external accounts and make it publicly visible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.