skill-to-mermaid

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill is being sent to Review because its only skill file is opaque binary data instead of readable Markdown instructions, so its behavior cannot be audited.

Do not install this version unless the publisher provides a plaintext UTF-8 SKILL.md or a documented decoding process with a hash linking the reviewed source to the distributed artifact. The issue is lack of auditability, not confirmed malware.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:1

Finding

Opaque Binary Content Prevents Security Review of the Skill Definition

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:1-24
Vulnerability Type: Opaque or encrypted skill configuration
Risk Level: Medium

Evidence

The file could not be decoded as ordinary text. Its printable content begins with the following binary-data excerpt:

text

b\x14#e\x00o\x01\x00\x00\x00\x01E-SafeNet\x00\x00\x00LOCK\x00\x00...

The remainder of lines 1-24 consists of binary control characters and high-entropy data rather than readable Markdown instructions. No readable source-code segment was available because the entire file appears encrypted, encoded, corrupted, or stored in an undocumented binary format.

Technical Analysis

SKILL.md is the project's only file and therefore represents the complete auditable skill artifact. A skill definition is expected to be reviewable as plaintext Markdown, but this file cannot be decoded and contains the markers E-SafeNet and LOCK followed by opaque binary data.

This prevents reviewers and consumers from determining the instructions, permissions, external interactions, or commands that the skill may contain after decoding. It also prevents verification that the distributed artifact matches an independently reviewed source. This is classified as an insecure skill coding and distribution practice rather than confirmed malicious execution.

The available evidence does not establish that the content performs command execution, retrieves remote payloads, modifies memory, establishes persistence, exfiltrates information, or escalates privileges.

Attack Path

A potential exploitation path is conditional on an external component accepting and decoding this undocumented format:

1. A consumer installs or accepts the opaque skill artifact without reviewing its plaintext instructions.
2. A separate loader, decryption component, or runtime interprets the concealed content.
3. Instructions unavailable during static review become active.
4. If those co ...[truncated 866 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the binary artifact with a plaintext, UTF-8 encoded SKILL.md containing the complete skill instructions.
2. Remove encryption, packing, obfuscation, or proprietary wrapping from the artifact submitted for review.
3. If binary protection is operationally required, provide the exact plaintext source, documented decoding procedure, and cryptographic hash linking the reviewed source to the distributed artifact.
4. Validate the resulting file in a clean environment and confirm that standard Markdown tooling can decode it without errors.
5. Resubmit the exact distributable package for security review after its effective instructions and behavior are visible.
6. Do not load or execute the current artifact with elevated permissions until its decoded contents have been independently reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.