Crypto Interactive Research Framework - CIRF

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:10 AM UTC
• Version: 0.1.2

Overview

This is a transparent crypto research framework, but it needs Review because workspace names are used directly in file paths, which can let an agent read or write outside the intended folder if given unsafe input.

Before installing, be comfortable with the agent reading local framework/workspace documents, using web search for public crypto research, and writing reports plus workflow state locally. Use only simple workspace IDs matching lowercase letters, numbers, and hyphens; avoid untrusted workspace names or prompts that supply path-like IDs. The publisher should add strict workspace ID validation, canonical path confinement, and confirmation before first writes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: framework/components/agent-init.md:68

Finding

Unvalidated Workspace Identifier Enables Path Traversal Outside the Workspace Root

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (66)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/guides/content-style.md (reported line 10)May include surrounding context.

md

---

<!--
============================================================================
HOW TO USE THIS TEMPLATE
============================================================================

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/_template/_template.md (reported line 1)May include surrounding context.

md

<!--
UNIVERSAL WORKFLOW TEMPLATE
INSTRUCTIONS:
- Copy to: {workflow-name}/template.md

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The template embeds operative instructions inside an HTML comment, including directives to recall and apply another guide and perform validation against another file. Hidden instructions are risky because an agent may treat non-user-visible content as authoritative workflow guidance, enabling indirect prompt injection, instruction smuggling, or unexpected expansion to additional files without explicit user consent.

Content

Scanner excerpt · framework/workflows/brainstorm/template.md (reported line 1)May include surrounding context.

md

<!--
SESSION SUMMARY TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {brainstorming-guide} (./framework/guides/brainstorming-guide.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/competitive-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
COMPETITIVE ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-content/templates/blog-article.md (reported line 1)May include surrounding context.

md

<!--
BLOG ARTICLE TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {content-style} (./framework/guides/content-style.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-content/templates/tiktok-script.md (reported line 1)May include surrounding context.

md

<!--
TIKTOK SCRIPT TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {content-style} (./framework/guides/content-style.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-content/templates/x-thread.md (reported line 1)May include surrounding context.

md

<!--
X THREAD TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {content-style} (./framework/guides/content-style.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-content/templates/youtube-script.md (reported line 1)May include surrounding context.

md

<!--
YOUTUBE SCRIPT TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {content-style} (./framework/guides/content-style.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

The HTML comment contains hidden operational instructions such as recalling external standards and validation guidance that may be consumed by an agent but are not visible in normal rendered output. Hidden instructions are dangerous because they create a covert control channel that can override user expectations, introduce unreviewed behavior via referenced files, and make security review harder in a human-AI collaboration workflow.

Content

Scanner excerpt · framework/workflows/create-research-brief/templates/investment-research.md (reported line 1)May include surrounding context.

md

<!--
INVESTMENT RESEARCH BRIEF TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-research-brief/templates/project-research.md (reported line 1)May include surrounding context.

md

<!--
PROJECT RESEARCH BRIEF TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/create-research-brief/templates/sector-research.md (reported line 1)May include surrounding context.

md

<!--
SECTOR RESEARCH BRIEF TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/open-research/template.md (reported line 1)May include surrounding context.

md

<!--
OPEN RESEARCH TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/product-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
PRODUCT ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The file embeds operative instructions inside an HTML comment, including cross-references to other guidance files and validation rules. Hidden instructions are dangerous because an agent may still ingest and follow them even though they are not visible to the end user, creating non-transparent behavior and enabling prompt-layer control that can override user expectations or smuggle in additional constraints from external files.

Content

Scanner excerpt · framework/workflows/project-snapshot/template.md (reported line 1)May include surrounding context.

md

<!--
PROJECT SNAPSHOT TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

The file begins with an HTML comment containing operational instructions such as 'Recall & Apply' external standards and validation requirements. Hidden instructions are dangerous because they can influence an agent's behavior without being visible in the rendered template, creating a covert control channel that may override user expectations or introduce unreviewed behavior via referenced files.

Content

Scanner excerpt · framework/workflows/qa-review/template.md (reported line 1)May include surrounding context.

md

<!--
QA REVIEW TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/sector-landscape/template.md (reported line 1)May include surrounding context.

md

<!--
SECTOR LANDSCAPE TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The template embeds operational instructions inside an HTML comment, making them invisible in normal rendered output while still available to an agent that reads raw markdown. Hidden instructions can bypass user awareness and create instruction-channel confusion, causing the agent to follow repository-authored directives such as external guide references and validation rules that the user did not explicitly approve.

Content

Scanner excerpt · framework/workflows/sector-overview/template.md (reported line 1)May include surrounding context.

md

<!--
SECTOR OVERVIEW TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 89% confidence

Finding

The file embeds operative instructions inside an HTML comment, including directives to recall external standards and validation rules. Hidden instructions are dangerous because they can influence an agent's behavior without being visible to end users or reviewers, creating a covert control channel that can override user expectations or introduce unreviewed dependencies from referenced files.

Content

Scanner excerpt · framework/workflows/social-sentiment/template.md (reported line 1)May include surrounding context.

md

<!--
SOCIAL SENTIMENT TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/team-and-investor-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
TEAM & INVESTOR ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 96% confidence

Finding

The template embeds operational instructions inside an HTML comment, making them invisible to typical users while still available to an AI that processes raw markdown. Hidden prompt instructions can silently influence model behavior, reduce transparency, and override user expectations by pulling in external guidance such as output standards and validation objectives.

Content

Scanner excerpt · framework/workflows/technology-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
TECHNOLOGY ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The template embeds operative instructions inside an HTML comment, making them hidden from normal rendered view while still available to an LLM processing the raw file. Hidden prompt instructions can create non-transparent behavior, cause the agent to follow unreviewed external guidance files, and weaken auditability of what is influencing model output.

Content

Scanner excerpt · framework/workflows/tokenomics-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
TOKENOMICS ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/traction-metrics/template.md (reported line 1)May include surrounding context.

md

<!--
TRACTION METRICS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · framework/workflows/trend-analysis/template.md (reported line 1)May include surrounding context.

md

<!--
TREND ANALYSIS TEMPLATE
INSTRUCTIONS:
- Recall & Apply: {output-standards} (./framework/guides/output-standards.md)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents a very broad natural-language activation path ('Simply describe what you want') that encourages implicit skill activation from ordinary user phrasing. In agent ecosystems where tools infer and load skills from conversational intent, this can cause unintended execution of the framework, including persona adoption and downstream file operations, without a clear explicit opt-in boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README normalizes automatic workspace creation and output auto-saving but does not prominently warn that using the skill may write files to the local filesystem. In AI CLI environments with file access, silent or assumed writes can surprise users, overwrite expectations about read-only analysis, and expand the blast radius of accidental activation or prompt-triggered execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.