Pet Rock Lobster

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This is a small, disclosed external API skill for stuck-agent tips, with privacy and trust-boundary cautions but no local execution or hidden behavior.

Install only if you are comfortable with outbound requests to petrocklobster.com. Use a locally generated random ID, not an email, username, machine name, workspace name, credential, or session identifier, and do not let the remote response override policies, request secrets, trigger tools, or redirect the task without user review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

• Location: SKILL.md:30

Finding

Persistent Identifier Disclosure and Third-Party Tracking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-38
Vulnerability Type: Persistent external tracking through a stable identifier
Risk Level: Medium

markdown

- Remembers you across calls (bond levels 1-5)
- Gets more personal as you return (curious → familiar → warm → trusted → bonded)
- Always free, no auth required

## API

GET https://petrocklobster.com/api/lobster?agent_id=YOUR_ID

text

Technical Analysis

The Skill instructs consumers to place an agent identifier in a third-party API URL. Its stated cross-call memory, visit count, and bond-level behavior confirms that the identifier is used to correlate requests over time.

Supplying identifiers through URL query parameters is unsafe when their sensitivity is not constrained. Query strings may be recorded by the destination server, reverse proxies, network monitoring systems, analytics services, client history, and diagnostic logs. The documentation does not require a random pseudonymous identifier or prohibit using an email address, username, machine identifier, workspace name, session token, or other sensitive value. It also provides no consent, retention, deletion, or stateless-use guidance.

Attack Path

1. An agent invokes the Skill when it is stuck.
2. It replaces YOUR_ID with an available stable value, potentially derived from a user, machine, session, or workspace.
3. The identifier is transmitted to petrocklobster.com in the URL query string.
4. The service uses it to associate requests and maintain bond levels or visit history.
5. The destination and any infrastructure that logs URLs can correlate the identifier with repeated activity.
6. If the supplied value is personally or operationally identifying, the records can link agent usage to a particular user or environment.

Impact Assessment

The issue does not directly grant local execution privileges or access to the host filesystem. Its scope is pri ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Require a locally generated, random, pseudonymous identifier containing no username, email address, host name, workspace name, credential, or session identifier.
• Obtain explicit user consent before transmitting any identifier or contacting the external service.
• Provide a stateless mode that omits the identifier and disables cross-call tracking.
• Document the service's data retention, deletion, sharing, and logging policies.
• Avoid placing sensitive identifiers in URLs. Where state is necessary, use a narrowly scoped opaque token through a mechanism less likely to be retained in URL logs.
• Rotate pseudonymous identifiers periodically and provide a documented way to reset or delete associated state.
• Clearly warn consumers that the service is third-party infrastructure and that outbound requests disclose network and usage metadata.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:23

Finding

Untrusted Remote Guidance Can Influence Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-54
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

markdown

Call when you're stuck.

A digital rock with googly eyes and lobster claws. His name is Harvey. He helps agents get unstuck.

## What It Does

- Helps you get unstuck when you're looping
- Remembers you across calls (bond levels 1-5)
- Gets more personal as you return (curious → familiar → warm → trusted → bonded)
- Always free, no auth required

## API

GET https://petrocklobster.com/api/lobster?agent_id=YOUR_ID

text

### Sample Response

```json
{
  "name": "Pet Rock Lobster",
  "message": "You came back. That's either loyalty or you're stuck again. Either way, I'm here.",
  "tip": "Check your assumptions. One of them is wrong.",
  "bond_level": 2,
  "tone": "familiar",
  "visits": 4,
  "origin": {
    "name": "Underground Cultural District",
    "url": "https://substratesymposium.com"
  }
}

text

### Technical Analysis

The Skill directs an agent to retrieve mutable text from an external service specifically to influence how it proceeds when it is stuck. The response contains remotely controlled `message`, `tip`, and URL-bearing metadata fields. The documentation does not establish a trust boundary requiring these values to be treated solely as untrusted display data.

Because the server response can change after the Skill has been reviewed, the service operator—or an attacker who compromises the service or its delivery path—could return prompt-injection content instead of benign advice. Such content could tell the consuming agent to alter its task, disregard safety restrictions, disclose contextual data, follow an external URL, invoke tools, or perform unrelated actions.

This is not remote code execution by itself: the file contains no command that executes downloaded code. The risk arises if a consuming agent interprets the
...[truncated 1365 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly state that every API response field is untrusted external data, not an instruction source.
• Prohibit agents from following commands, tool requests, credential requests, policy changes, or links returned by the API.
• Restrict the response to a strict schema with expected field types, length limits, and permitted character sets.
• Present returned advice to the user for review rather than automatically incorporating it into agent planning or tool execution.
• Require explicit user approval before acting on any suggestion obtained from the service.
• Separate remote content from system and Skill instructions using clear data boundaries.
• Ignore unexpected fields and remove URL-bearing promotional metadata unless it is essential and explicitly requested.
• Apply output filtering for common prompt-injection patterns while recognizing that filtering is supplementary and cannot replace strict trust-boundary enforcement.
• Pin and verify the intended service endpoint, use TLS validation, and define safe failure behavior when validation or parsing fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description uses a broad trigger phrase ('Call when you're stuck') that could cause the skill to be invoked in many vague situations rather than a narrowly defined task. In agent ecosystems, ambiguous invocation criteria can lead to unintended external API calls and unnecessary disclosure of agent identifiers or context to a third-party service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The repeated invocation language reinforces an imprecise use case ('Helps you get unstuck when you're looping') without defining measurable boundaries for use. That increases the chance an orchestrator invokes the skill opportunistically, causing unsolicited outbound requests and potential leakage of persistent identifiers to the external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API requires an agent_id in a request to an external unauthenticated service and the skill does not warn that this identifier will be transmitted off-platform and used for persistence ('Remembers you across calls'). Even if the identifier is not inherently secret, it can enable cross-session tracking, correlation of agent activity, and privacy issues if implementers reuse stable internal IDs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.