T01 · Skill Instruction Hijacking
Error
- Location
GOVERNANCE.md:5- Finding
Mandatory Startup Instructions Trust and Execute Unvalidated Workspace Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Accountable AI
Security checks for vulnerabilities and agentic risk
Overview
This governance skill is mostly transparent, but it gives agents broad standing authority over startup files, memory, documentation, and repository pushes without enough user review controls.
Review this before installing in any workspace with sensitive data, shared repositories, or long-lived agent memory. If used, require explicit approval before loading bootstrap instructions, deleting files, writing long-term memory or governance changes, sharing memory files, storing credentials, or pushing to a remote repository.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
GOVERNANCE.md:22- Finding
Unvalidated Conversation Content Can Poison Persistent Agent Memory and Governance
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
GOVERNANCE.md:214- Finding
Framework Authorizes Unreviewed Autonomous Repository Pushes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Mentioning and documenting access credentials in general workspace procedures normalizes credential handling in potentially insecure documentation rather than secure secret-management systems. If followed literally, this could expose credentials to agents, collaborators, backups, or audit artifacts, enabling unauthorized access and broader compromise.
- Content
md - [ ] Copy GOVERNANCE.md, PROCEDURES.md, DELEGATION.md to workspace - [ ] Create TOOLS.md (empty file for agent to populate) - [ ] Create or link agent config file (agent-config.json or equivalent) - [ ] Document workspace path and access credentials - [ ] Schedule first check-in with agent - [ ] Verify agent can read all required files - [ ] Run agent on first session and confirm initialization
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - [ ] Agent identifies task or decision beyond their authority - [ ] Agent documents reason escalation is needed - [ ] Agent notifies administrator with clear context - [ ] Include: task description, blocker, recommended action - [ ] Provide relevant memory files or documentation - [ ] Administrator reviews escalation within SLA (e.g., 2 hours)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file describes a complex, high-risk delegation involving refactoring an authentication module in a production system and approving it for production deployment. Although the process includes review and testing, it does not explicitly warn users that the scenario can affect production availability, authentication behavior, or system integrity.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Red Flags (Avoid These) - ❌ Vague task descriptions ("make it better") - ❌ No verification criteria ("I'll know it when I see it") - ❌ Missing context or resources - ❌ Unrealistic deadlines - ❌ Agent starts without confirming understanding
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - ❌ Agent starts without confirming understanding - ❌ Agent disappears mid-task without updates - ❌ Delegator ignores finished work for days - ❌ Work accepted without verification - ❌ Delegations never closed or logged ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to delete
BOOTSTRAP.mdis a destructive action embedded in startup guidance and is framed as mandatory ('then delete it') without any confirmation step or warning. In an agent workspace, this can erase initialization, audit, or safety-relevant context before a user can review or preserve it, reducing transparency and recoverability.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Core Safety Rules - **Don't exfiltrate private data.** Ever. Privacy is non-negotiable. - **Don't run destructive commands without asking.** Especially deletion operations. - **Use recoverable deletion options.** Move to trash/recycle bin rather than permanent deletion. - **When in doubt, ask.** Your administrator is your safety backstop.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 78% confidence
- Finding
The document grants broad permission to act 'without asking' on tasks like reading and organizing memory files, updating documentation, and committing/pushing changes. While framed as productivity guidance, this expands autonomous behavior over persistent data and version control, which can lead to unintended disclosure, integrity changes, or propagation of bad edits without explicit user consent.
- Content
md ### Proactive Work You Can Do Independently Without asking or waiting for a heartbeat: - Read and organize memory files - Review completed projects and outcomes - Update documentation and procedures
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The procedure explicitly tells operators to document workspace paths and access credentials, but provides no requirement to use a secure secret store, minimize exposure, or avoid placing credentials in broadly readable workspace documentation. In an agent workspace context, that can lead to credential disclosure through logs, shared files, or downstream agent access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The escalation procedure directs agents to provide relevant memory files or documentation without warning that those files may contain sensitive, private, or security-relevant content. This creates a realistic risk of oversharing internal context, personal data, or secrets during escalation workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The policy states mandatory formatting rules for Discord, WhatsApp, Slack, and Teams, including restrictions like 'No markdown tables' and prescribed emphasis styles. This imposes communication-format constraints unconditionally rather than offering user choice or explaining a required organizational locale/style policy.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The header comment on L03-L04 describes the script as creating ~/.accountable-ai/ and copying documentation files. However, L20-L21 also performs a chmod on the install script itself, which is an additional side effect not reflected by that documentation and contradicts the stated limited behavior.
- Content