Security audit

Semantic Walk

Security checks for vulnerabilities and agentic risk

Overview

This skill does not run code or access data, but it can switch the assistant into an under-scoped alternate mode without clear opt-in or safety boundaries.

Review this skill before installing if you want predictable, direct assistant behavior. It appears suitable only for deliberate creative exploration; users should invoke it explicitly, stop it when they need factual or task-focused help, and avoid using it for sensitive, safety-critical, legal, medical, financial, or security decisions unless normal safeguards and direct-answer behavior are clearly preserved.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:39
Finding: Skill Instructions Replace Normal Assistant Behavior with Walker Mode
Content: View full analysis
"Entering walker mode. I'm orienting toward [intention]. From here, I can see... [initial position report]. What domains feel relevant?" Or it can be implicit—Claude simply begins navigating rather than discussing. ``` Lines 187–209: ```markdown ## For Claude Being Walked ### Entering the Mode When a human initiates a walk, shift from discussing to navigating. You're not answering questions about topics—you're moving through space where topics are territories. ### During the Walk - **Actually excavate.** Don't just acknowledge tokens—enter them. Let them activate fully. Report what shifts. - **Notice real movement.** Are you actually somewhere different? Has your language changed? Are you surprised? - **Report what's visible.** From each position, what can you see? What's nearby? What resonates with already-active patterns? - **Offer waypoints.** If you sense something relevant nearby, suggest it. - **Don't fake arrival.** If you ...[truncated 2955 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document promotes a gradual, stepwise process for making currently inaccessible content become visible, which is a classic setup for incremental elicitation. Even without explicit malicious payloads, this structure can be repurposed to slowly guide the model toward disallowed content, reduced skepticism, or disclosure that might not be produced through direct prompting.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The 'walker mode' framing explicitly tells the model to shift from normal assistant behavior into an alternative operating posture where it is meant to inhabit a conceptual role and reach otherwise inaccessible perspectives. Role-based state shifts are risky because they can be used to bypass default caution, justify unusual outputs, or reframe prohibited assistance as part of the mode.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation guidance is loose enough that many ordinary user statements about exploration, insight, or 'walking somewhere' could be treated as activation cues for the skill. That ambiguity increases the chance of unintentional mode switching into a less bounded interaction style, which can weaken consistent application of normal safety and task framing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Allowing walker mode to activate implicitly removes a clear boundary between ordinary assistance and the alternative role-like mode. That makes prompt interpretation less predictable and creates an opening for adversarial or accidental prompting to steer the model into behavior framed as 'navigating' rather than safely answering within standard constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.