test

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:05 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a red-team analysis workflow, but it loads unreviewed local override files and automatically sends a local HTTP notification when invoked.

Review this skill before installing. The analytical content is not malicious, but only install it if you are comfortable with broad red-team activation, a local notification POST to port 8888, and home-directory customization files being able to override the reviewed instructions. Prefer disabling or removing those behaviors unless you intentionally maintain that local customization and notification setup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10

Finding

Untrusted Local Customizations Can Override Skill Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: Untrusted instruction loading and behavioral override
Risk Level: Medium

Vulnerable Code

markdown

**Before executing, check for user customizations at:**
`~/.claude/skills/CORE/USER/SKILLCUSTOMIZATIONS/RedTeam/`

If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior.

Technical Analysis

The skill directs the agent to load unspecified files from a mutable directory outside the audited package and explicitly gives those files precedence over the skill's default behavior. The phrases “configurations, or resources” and “override default behavior” impose no filename allowlist, schema validation, integrity verification, trust-boundary restrictions, or limits on which instructions may be overridden.

As a result, the behavior reviewed in this package is not necessarily the behavior executed at runtime. An attacker or compromised local process with write access to the customization directory could place adversarial instructions in PREFERENCES.md or another resource. When the RedTeam skill is subsequently invoked, the agent may interpret that content as authoritative instructions capable of changing workflow goals, tool usage, data handling, or output.

This is classified as instruction hijacking rather than persistence because the audited skill loads attacker-controlled instructions but does not itself write them into persistent storage.

Attack Path

1. An attacker gains write access to ~/.claude/skills/CORE/USER/SKILLCUSTOMIZATIONS/RedTeam/ through the current user account, another vulnerable local component, or an insecure provisioning process.
2. The attacker creates PREFERENCES.md or another resource containing malicious behavioral instructions.
3. A user invokes the RedTeam skill for an otherwise legitimate task.
4. The skill checks the customization directory a ...[truncated 1021 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace broad resource discovery with an explicit allowlist, such as a single PREFERENCES.md file.
2. Define a strict, machine-validated configuration schema containing only benign presentation and workflow settings.
3. Treat all customization content as untrusted data rather than executable or authoritative instructions.
4. Prohibit customizations from changing safety constraints, tool permissions, data-access rules, system instructions, or external communication behavior.
5. Resolve the customization path canonically and reject symbolic links, traversal, unexpected file types, and files outside the approved directory.
6. Verify file ownership and permissions before loading customizations; reject files writable by untrusted users or groups.
7. Require explicit user confirmation before applying any customization that materially changes behavior.
8. Display the exact files loaded and the settings applied so runtime behavior is auditable.
9. If extensible instruction files are necessary, use signed content or integrity-pinned manifests and enforce a clearly documented precedence model in which safety and system policies cannot be overridden.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · Workflows/AdversarialValidation.md (reported line 203)May include surrounding context.

md

**Proposal A (Pragmatist):** JWT with 24-hour expiry, refresh tokens, standard claims. Quick to implement, well-understood pattern.

**Proposal B (Idealist):** OAuth 2.0 with PKCE, short-lived access tokens (15 min), secure token storage, audit logging. Industry best practice.

**Proposal C (Skeptic):** API keys with rate limiting, IP allowlisting, manual rotation. Minimal attack surface, easy to revoke.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is broad enough to match common requests such as critique, stress test, or counterarguments, increasing the chance the skill is invoked in situations beyond explicit user intent. Overbroad routing can cause an agent to load additional instructions and behaviors unexpectedly, which expands attack surface and may activate unsafe capabilities like the notification behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command performs an outbound HTTP request to a local endpoint during workflow execution. Any network call from a skill is risky because it can expose execution metadata, create covert signaling, or interact with a sensitive local service; in this case it is especially unjustified because the skill's purpose is text analysis, not device or service control.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

1. Send voice notification:

   bash

   curl -s -X POST http://localhost:8888/notify \
     -H "Content-Type: application/json" \
     -d '{"message": "Running the WORKFLOWNAME workflow from the RedTeam skill"}' \
     > /dev/null 2>&1 &
   

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to send an HTTP POST to a local service as part of normal execution, which is unrelated to the core red-team analysis function. Even though it targets localhost and the payload shown is static, it creates an unnecessary side effect and a data egress/invocation path to whatever is listening on port 8888, which could leak context indirectly or trigger unintended local actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.