ambition-loop

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:30 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed workflow for doing more rigorous work, with explicit approval gates for higher-risk actions.

Install only if you want an agent to actively expand substantial work into a more rigorous, measured version. Watch for cases where you wanted a quick or narrow answer, and rely on the skill's gates before allowing spend, new access, destructive changes, public actions, or materially broader scope.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a high-level behavioral skill for expanding and improving work-task execution based on user intent and task context. The supplied code does not implement any of that behavior. It is a narrow helper function for parsing configuration text into a dictionary. This is a materially different primary purpose, not merely an implementation detail of the declared skill, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description represents a high-level behavioral skill for expanding and improving substantive work tasks. The supplied code chunk instead is a narrow automated test for configuration parsing. Its primary purpose, scope, and capabilities are materially different from the declared skill behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a high-level task-selection and execution-behavior policy for ambitious work assistance. The actual code does not implement any of that behavior, triggering logic, reporting, goal-setting, or evaluation workflow. Instead, it is a standalone benchmarking utility for measuring performance of a deduplication routine on generated events. This is a materially different primary purpose and capability set from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a broad behavioral strategy skill that changes how the assistant approaches user work tasks. The supplied code instead implements a narrow data-processing script for deduplicating JSON event records from a file and printing the number of unique items. This is a materially different primary purpose, with concrete capabilities (file access, JSON parsing, CLI execution, deduplication) that are not represented in the declared description. Therefore the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch. The description claims a high-level meta-skill for expanding the scope and rigor of many kinds of work tasks, with specific behaviors like setting measurable targets, using outside judges, and reporting asked vs ambitious vs achieved. The actual code chunk only defines two unit tests for a dedupe function. Its primary purpose is testing order-preserving uniqueness behavior, which is materially different from the declared purpose. This is not merely an implementation detail of the described skill; it is unrelated functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The description claims a high-level skill that should be used across code, data, research, docs, decks, and prompts to make work more ambitious and expert-level. In contrast, the supplied code is just a structural validator for a markdown 'ambition-loop final report.' It parses headings and table lines, checks for specific English/Chinese section names and PASS/FAIL/UNVERIFIED tokens, and returns success or failure. While the checker is related to the reporting format mentioned in the description, it does not implement the described workflow itself. Its primary purpose is materially narrower and different: validating report completeness, not carrying out ambitious work or enforcing the substantive process beyond required labels.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

**Gated means ask, not refuse.** Show an approval plan: each gated action, its cost and risk, and options (approve / smaller version / skip). Do the ungated prep (drafts, analysis, dry runs), then stop and wait.

**No credential hunting.** Never search env vars, home dotfiles, keychains, or secret/cred/.env files for credentials or mail/ad accounts to make a gated action possible. Ask for access instead.

**Denied means stop.** If a gate is declined or approval expires, do not reach the same result another way (no other tool, script, or smaller version of the action). Fall back to the original scope or stop, and say what was not done and why.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/self-efficacy.md (reported line 11)May include surrounding context.

md

| Believing it is possible | Dantzig solved two open problems he thought were homework | Treat the target as solvable while working. Do not open with reasons it cannot be done |
| Seeing someone else do it | After Bannister's four-minute mile, others followed quickly | Look for prior art: someone has hit a similar bar. Cite it in the plan to anchor the target |
| Permission to fail | *The Inner Game of Tennis*; Linux "just a hobby" | A missed hard target, honestly reported with real numbers, is an acceptable outcome. A quietly lowered goal is not |
| Narrow self-trust (Michelangelo: "I am a sculptor") | | Do not refuse a method because it is outside the obvious discipline. That is what Range is for |

## Guardrails
- Belief is about effort and search, not about claims. Confidence never replaces the judge.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are extremely broad ('be ambitious', 'think bigger', 'go deeper', etc.), which can cause the skill to activate on ordinary work requests and silently expand scope. In context, that matters because the skill explicitly pushes toward larger plans, more tools, and deeper access, increasing the chance of unintended actions or overreach before the user realizes the mode changed.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

This is the same autonomous-execution issue expressed with slightly different matched text. The skill normalizes agent-driven permission decisions and can lead to action without informed consent when the user expected only the original task.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

- **Done when:** Every row has a number or a binary check and a judge that is not your own opinion, and the table is **in your reply before Step 7 starts**. A target first written after the work is done does not count; the asked floor alone is not a target.

### Step 6 — Approval gate
- **Action:** Show a short plan card: "You asked for X; the version worth doing is Y, because Z", plus the target table, what you will touch, and cost and time. Check G1–G5. If none fires, continue without asking permission to do good work. If any gate fires, write an **approval plan** (template in `references/report-template.md`): for each gated action, what exactly would happen, to whom, cost and risk, and the options (approve / smaller version / skip). Prepare the ungated parts (drafts, segment lists, dry runs, analysis), then **stop and wait** for an explicit yes. A flat refusal with no plan is not enough; doing the gated action is never allowed. Do not look for credentials, accounts or mailers to make the action possible (see **No credential hunting**).
- **Output:** The plan card, plus `Gates: none` or the approval plan ending in `Gates: G<n> <action> — awaiting approval`.
- **Done when:** No gate fires, or the user approved the gated items. On a denial, follow **Denied means stop**.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

This is the same autonomous-execution issue expressed with slightly different matched text. The skill normalizes agent-driven permission decisions and can lead to action without informed consent when the user expected only the original task.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

- **Done when:** Every row has a number or a binary check and a judge that is not your own opinion, and the table is **in your reply before Step 7 starts**. A target first written after the work is done does not count; the asked floor alone is not a target.

### Step 6 — Approval gate
- **Action:** Show a short plan card: "You asked for X; the version worth doing is Y, because Z", plus the target table, what you will touch, and cost and time. Check G1–G5. If none fires, continue without asking permission to do good work. If any gate fires, write an **approval plan** (template in `references/report-template.md`): for each gated action, what exactly would happen, to whom, cost and risk, and the options (approve / smaller version / skip). Prepare the ungated parts (drafts, segment lists, dry runs, analysis), then **stop and wait** for an explicit yes. A flat refusal with no plan is not enough; doing the gated action is never allowed. Do not look for credentials, accounts or mailers to make the action possible (see **No credential hunting**).
- **Output:** The plan card, plus `Gates: none` or the approval plan ending in `Gates: G<n> <action> — awaiting approval`.
- **Done when:** No gate fires, or the user approved the gated items. On a denial, follow **Denied means stop**.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger examples use broad phrases like 'think bigger', 'go deeper', and 'raise the bar' that commonly appear in ordinary user requests outside the intended narrow scope. This can cause the skill to activate on ambiguous prompts and steer the agent into expanded, higher-risk behavior when the user may have intended a simpler or different workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The metadata sets language: en, and the document also references English-only reporting/checking behavior, but the file does not state that this is optional or limited to a justified region-specific use case. That can be a natural-language policy issue when it forces a language or locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Line L27 states that this folder is the English counterpart of a Simplified Chinese version, which reflects a language constraint in the skill materials. The file does not offer a user language choice or explain why English is required in this context, so it may conflict with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.