Security audit

AI Collaboration Profile Builder

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill coherently helps users create an agent collaboration profile and does not show hidden execution, credential use, network access, or destructive behavior.

Review the generated profile before reusing it with other agents, because it may encode personal work preferences, values, and collaboration rules that affect future responses. Avoid adding private details you would not want carried into other AI sessions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- Mark unanswered or conflicting items explicitly. - If the user asks for a simple personality label, explain that this skill optimizes for collaboration quality and actionability, then redirect to practical traits. ## Output Rules - Default opening: restate the real problem or goal, then give the conclusion. - Optimize for decision value, not coverage.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/examples.md (reported line 12)May include surrounding context.
md
### Observed signals - Repeatedly wants the assistant to check whether the question is being asked at the right level - Strongly dislikes information without judgment - Wants deliverable-first collaboration and measurable outputs - Prefers direct, dense, structured writing - Wants blind spots and higher-level framing issues surfaced

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/questionnaire-v1.md (reported line 18)May include surrounding context.
md
### Observed signals - Repeatedly wants the assistant to check whether the question is being asked at the right level - Strongly dislikes information without judgment - Wants deliverable-first collaboration and measurable outputs - Prefers direct, dense, structured writing - Wants blind spots and higher-level framing issues surfaced

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/output-schema.md (reported line 103)May include surrounding context.
md
- Do not dump information without judgment.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/output-schema.md (reported line 102)May include surrounding context.
md
Write 4 to 8 short imperative rules. Focus on the most stable and highest-leverage instructions, for example: - Do not answer too early without checking the problem frame. - Do not dump information without judgment. - Make assumptions explicit.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The example explicitly frames the interaction around a Chinese-speaking user and includes a "Chinese prompt," but the file does not state that language selection is user-driven or optional. Because SQP-3 covers natural-language locale policy concerns, this can be read as a language-specific handling pattern without an explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown template includes a fixed 'Language: [preferred language]' field in a user profile. Under the policy, language constraints are acceptable when they reflect user choice, but here the template does not explicitly say the language is optional at interaction time or that the assistant should offer a choice when appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The USER.md template again specifies 'Language: [preferred language]' as a profile field. Because the file is a reusable template, this wording can encourage downstream skills or profiles to assume a fixed language requirement without clearly documenting user choice or offering alternatives.
Content: No source excerpt is available for this finding.