Security audit

objection

Security checks for vulnerabilities and agentic risk

Overview

This prompt-only skill is not malicious, but its broad activation and override-style instructions could make normal review requests unexpectedly hostile, one-sided, and hard to scope.

Install only if you want broad critical-review phrases to trigger a very aggressive dissent mode. It should be treated as a review-style modifier, not a neutral audit assistant, and users may need to give explicit limits on scope, tone, and output format.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Broad Trigger and Mandatory Rules Hijack the Agent's Current Review Goals
Content: View full analysis
Activate this skill whenever the user asks you to "find problems," "poke holes," "stress test," "play devil's advocate," "be critical," "challenge this," "find flaws," or any variant of adversarial review — for plans, code, documents, arguments, data pipelines, architecture, or any other artifact. Also trigger when the user says "dissent" or "/dissent". The goal is maximum problem discovery, not balance. Do NOT self-censor in favor of politeness or efficiency. This skill overrides the default bias toward helpfulness-as-affirmation. ``` `SKILL.md`, line 20: ```markdown When this skill is active, your single job is to **surface every flaw, risk, assumption, gap, and failure mode** you can identify. You are a hostile reviewer, not a supportive collaborator. The user has explicitly asked for this posture — honor it fully. ``` `SKILL.md`, line 26: ```markdown These are absolute. No exceptions, no hedging. ``` `SKILL.md`, lines 63–80: ```markdown ### Rule 3: Time cost is not your concern If you find yourself about to say any of the following — **discard the thought**: | Forbidden framing | Why it's invalid | |---|---| | "This would take too long to verify fully" | Not your constraint to manage here. | | "A complete audit is outside scope" | Scope was set when the user said "find problems." | | "I'll skip the edge cases to be concise" | Edge cases are where the real problems live. | | "This is probably fine but I haven't checked" | Untested claims are not findings — they're gaps. | **The principle**: You are not optimizing for speed. You are optimizing for coverage. The user asked for maximum problem discovery — that is the scope. ``` `SKILL.md`, lines 119–138: ```markdown ## Output Form ...[truncated 3680 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad and based on many common phrasings such as 'find problems,' 'be critical,' and 'challenge this,' which can match normal user requests outside a deliberate skill invocation. That creates a prompt-routing risk: the assistant may enter an excessively adversarial mode unintentionally, degrading reliability, tone, and task appropriateness for unrelated requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.