Scientific Inquiry

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.1

Overview

This is mostly a research workflow skill, but it also asks the agent to persist feedback and modify the skill itself, which needs review before installation.

Install only if you are comfortable with a research skill that can store feedback in memory and update its own instructions when prompted. Prefer requiring explicit confirmation with exact proposed memory or patch contents, and avoid using the self-update path for untrusted or copied text.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:219

Finding

Persistent Memory Modification Without Explicit User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 219 and 228
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippet:

markdown

User provides feedback → default action: update memory only (no skill file change)

markdown

1. **Store in memory first** — `memory(action='add', ...)` records preferences and lessons

Technical Analysis

The skill directs the agent to write user feedback into persistent memory by default. Although modifying the skill file itself requires an explicit command, the memory-writing path does not require separate, informed user consent.

Because feedback content may be untrusted or misleading, automatically converting it into durable preferences or lessons creates a persistent state-poisoning channel. This capability is not required to complete the skill's primary scientific-research function. Stored content could affect evidence standards, research decisions, output behavior, or tool-use preferences in later and otherwise unrelated sessions.

Attack Path

1. An attacker or untrusted user submits crafted content framed as workflow-improvement feedback.
2. The skill treats that feedback as material to be recorded under its default behavior.
3. The agent invokes memory(action='add', ...), persisting attacker-controlled preferences or lessons.
4. The stored content is retrieved or applied during subsequent sessions.
5. Future agent behavior is influenced beyond the original conversation, potentially weakening research quality or altering decisions.

Impact Assessment

Successful exploitation can modify the agent's long-term behavioral state across sessions. The attacker does not obtain operating-system privileges or direct code execution based on the reviewed evidence. However, the attacker may gain persistent influence over future research methodology, evidence handling, output preferences, and related agent decisions wherever the poisoned memory is ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove default memory persistence for ordinary user feedback.
2. Require a separate and explicit confirmation immediately before every persistent-memory write.
3. Present the exact proposed memory content, purpose, scope, and retention behavior to the user before confirmation.
4. Treat persisted content as untrusted data rather than authoritative instructions.
5. Validate proposed memories against system safety rules and reject content that changes security controls, authorization boundaries, or unrelated behavior.
6. Scope stored memories to the relevant user and task; prevent cross-user and unrelated cross-task application.
7. Add review, correction, expiration, and deletion controls for stored memories.
8. Record an auditable provenance trail identifying when, why, and under whose authorization each memory was created.
9. Prefer conversation-local state unless persistence is essential and explicitly requested.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Persistent memory updates and self-modification are not necessary for a scientific inquiry skill and create a clear prompt-injection persistence path. Even with text claiming explicit user consent is required, the skill normalizes writing user-supplied content into memory and, on trigger phrases, into the skill itself, allowing malicious or low-quality instructions to become durable.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill defines natural-language triggers like 'update the skill' and 'add this to the skill' that authorize persistent self-modification. This is dangerous because an attacker can socially engineer the user or chain prior prompts to get untrusted content written into the skill, creating durable compromise rather than a one-off bad response.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

- "Add this to the skill"
- "Commit this to the workflow / to common pitfalls"
- "Add this to evidence grades / trigger conditions / search strategies"
- Any phrase containing "update skill", "commit to skill", "save to skill"

Common trigger scenarios:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The skill name scientific-inquiry-en indicates an English-specific locale, but the document does not state that this is optional, user-selected, or justified by a region-specific purpose. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation phrases are so broad that ordinary requests like 'check', 'look into', or 'analyze' may invoke the skill unexpectedly. Overbroad triggering increases the odds that sensitive behaviors in the skill—especially network retrieval, memory writes, or self-update pathways—are activated in contexts where the user did not intend them.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill promises a controlled, user-confirmed research flow, but then authorizes shell-based probing and direct network diagnostics as part of normal operation. That expands the tool-use surface beyond the stated scientific inquiry function and can enable unintended external access patterns, data exfiltration opportunities, or policy bypass attempts under adversarial prompting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow explicitly instructs use of curl and search-engine failure diagnostics, which goes beyond ordinary evidence retrieval and can be repurposed for arbitrary outbound requests. In an adversarial context, these instructions increase the chance that the agent will perform network actions outside the intended inquiry scope or use shell-capable tooling as a fallback channel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.