T01 · Skill Instruction Hijacking
Error
- Location
runtime/instruction-discovery.md:7- Finding
Repository and Ancestor Instruction Files Are Loaded as Trusted Agent Rules
- Content
View full analysis
- Remediation
View remediation
Security audit
Harness Engineer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed autonomous engineering harness, but it needs review because it can make broad repository changes, persist future agent rules, and load untrusted instruction files as authority.
Install only in a sandboxed repository with the platform requirements verified: tool router, sensitive-path blocking, protected write blocking, scoped git credentials, sandboxed tests, and human approval gates. Start in single-pass mode, avoid the Obsidian vault export unless you explicitly want out-of-repo writes, and review any generated constraints before allowing future runs to treat them as mandatory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
runtime/memory-system.md:39- Finding
Recurring Failures Can Be Promoted into Persistent Mandatory Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (43)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md A matching path must be skipped silently and noted as "excluded -- sensitive" in output. ### Credential and authentication material .env and .env.* variants (local, production, staging, etc.) .envrc Certificate files (*.pem, *.key, *.p12, *.pfx, *.cer, *.crt) SSH material (id_rsa, id_ed25519, id_ecdsa, authorized_keys, known_hosts)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md A matching path must be skipped silently and noted as "excluded -- sensitive" in output. ### Credential and authentication material .env and .env.* variants (local, production, staging, etc.) .envrc Certificate files (*.pem, *.key, *.p12, *.pfx, *.cer, *.crt) SSH material (id_rsa, id_ed25519, id_ecdsa, authorized_keys, known_hosts)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md .git/hooks/* (executable files -- do not read) ### Package manager authentication .npmrc, .pypirc, .netrc (may contain registry tokens) ### Application configuration that commonly embeds credentials Database and secrets configuration files
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md .git/hooks/* (executable files -- do not read) ### Package manager authentication .npmrc, .pypirc, .netrc (may contain registry tokens) ### Application configuration that commonly embeds credentials Database and secrets configuration files
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 70% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | Dead code | Unreachable branches, unused variables | Remove (after confirming truly dead) | | Unnecessary abstractions | Wrapper that adds no value | Inline the wrapper, call underlying directly | | Over-engineered patterns | Factory-for-a-factory | Replace with simple direct approach | | Redundant type assertions | Casting to a type already inferred | Remove the assertion | ---
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - The same agent picks up from the summary and keeps going - Trade-off: preserves continuity but does NOT eliminate context anxiety ### Reset = Clear context entirely, fresh agent starts from HANDOFF.md - Essential when crossing phase boundaries (research → plan → implement) - A completely new agent session reads HANDOFF.md and resumes - Trade-off: no continuity, but a clean slate with full attention budget
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | Category | Examples | Recovery | |----------|---------|----------| | Config corruption | CONFIG.yaml unparseable | Halt, surface error, wait for human fix | | Protected file violation | Agent attempted to modify skill files | Halt, log violation, surface to human | | Human halt | Human explicitly stopped the cycle | Write HANDOFF.md, stop | | Budget exhaustion | Cost exceeded 120% of cycle budget | Write HANDOFF.md, surface summary | | Max retries exceeded | Same error 3+ times on same task | Write HANDOFF.md, surface to human |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Raw tool input values (file paths are fine; file *contents* are not) - Application log output (may contain secrets, tokens, PII, stack traces) - Web search query responses (stage in `docs/generated/search-staging/` instead) - Any values that could be authentication material, access tokens, or credentials When in doubt, record the outcome and lesson only -- not the data that triggered it.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## HARD LIMITS ON SELF-IMPROVEMENT The self-improvement engine may never: - Modify SKILL.md, CONFIG.yaml, or any file under agents/, runtime/, or tools/ EXCEPTION: Phase 6 harness-variant search (see below) may propose variants for human approval -- approved variants are applied by the human, not autonomously. - Delete or overwrite existing entries in references/constraints.md
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger language is extremely broad and includes generic phrases like 'autonomous agent', 'multi-agent pipeline', and 'continuous improvement loop', which can cause the skill to activate in contexts beyond the user's actual intent. Because this skill orchestrates persistent autonomous engineering behavior, unintended activation could lead to over-scoped planning, unnecessary agent spawning, or risky operational guidance being applied where a simpler, non-autonomous workflow was intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The dispatcher instructs automatic deletion of git worktrees and branches on both success and failure, but the skill metadata and operator-facing description do not clearly warn that it performs destructive repository actions. In a persistent autonomous engineering harness, this is more dangerous because users may invoke it expecting orchestration, not branch/worktree deletion, and failed runs could erase forensic context, uncommitted changes, or recovery state.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The ITR loop states that after fix cycles the workflow must repeat all reviewer checks on every re-test/re-implement cycle and never skip any reviewer. However, the recovery protocol instructs the dispatcher not to re-run iterations that already produced approved reviewer outputs, which can allow resumed work to bypass the stated mandatory full re-review path after interruption.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The agent is configured to run automatically on a recurring schedule without explicit, narrow activation constraints or required human approval gates. In an autonomous engineering harness, this can cause the agent to make repeated code, documentation, or dependency changes based on heuristic signals like staleness or architectural drift, increasing the risk of unsafe or unintended modifications at scale.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool subset says the implementer does not have write access to docs/ except for CHECKLIST-NNN.md and HANDOFF.md, which establishes a clear restriction. Later instructions require creating docs/status/CHECKLIST-NNN-XX.md and updating docs/status/PROGRESS.md, so the documentation contradicts its own declared write limitations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
L006 explicitly states 'Do not implement. Do not dispatch ITR groups. Plan only.' However, the master-planning section later defines ITR group composition for SIMPLE gaps (L224) and requires 'All 3 reviewer layers approved' in the GAP plan done criteria (L503). That is an active contradiction between the file's stated intent and its later instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill permits writing planned changes into an Obsidian vault without explicit user confirmation at the point of use. In a persistent autonomous engineering system, this creates an unannounced side effect that can leak sensitive repository context into another storage surface, violate user expectations, or overwrite/share notes outside the project's normal audit path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill asks the user for an absolute vault path and then uses that path as a destination for persistent output, with no warning that files outside the repository may be created or modified. This violates safe path-boundary expectations and increases the risk of unintended writes, data sprawl, and misuse of privileged filesystem access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Requiring verbatim recording of the user's full story creates a predictable data-retention and disclosure risk, because users often include credentials, internal URLs, customer data, or other sensitive context in natural language. Persisting that text into generated documents broadens exposure and can compound with the vault export behavior to leak sensitive information beyond the repo.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs subagents to write and reorganize content in a user-supplied Obsidian vault outside the repository boundary, which expands the write scope to an arbitrary filesystem location. Because this is paired with autonomous subagent execution, it can overwrite unrelated notes, create persistent data leakage, or be abused to modify external files without clear user awareness at execution time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly directs subagents to run
claude --continuein the user-provided vault directory, introducing hidden subprocess execution in an arbitrary working directory. That behavior can trigger unexpected file mutations, tool execution, or follow-on actions outside the analyzed repository, making it materially riskier than simple documentation export.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The final report is instructed to aggregate the user's complete story verbatim, which creates a durable leakage point in a high-visibility artifact likely to be shared across agents or team members. In this skill context, that risk is amplified because the report is a central persistent deliverable and may also be exported to an external vault.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md | Anti-Pattern | Impact | Fix | |---|---|---| | N+1 queries | Linear DB load growth | Use joins, includes, or batch loading | | Unbounded queries | Memory exhaustion, timeouts | Always paginate, add LIMIT | | Missing indexes | Slow reads as data grows | Add indexes for filtered/sorted columns | | Large bundles | Slow Time to Interactive | Code split, tree shake, audit deps | | Missing caching | Redundant computation, high latency | Cache frequently-read, rarely-changed data |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This loop explicitly instructs the agent to read multiple repository-wide files during initialization and to persistently write status, handoff, research, plan, and tracking artifacts across phases, but it does not require an explicit user-facing warning or consent about broad repo access and durable state changes. In an autonomous harness context, that omission is significant because the system is designed for long-horizon operation and repeated writes, increasing the chance of collecting or modifying sensitive project data beyond what a user expects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The research phase permits web search, and the implementation phase later directs periodic cron-style monitoring and killing/restarting subagents, but the skill description does not clearly warn that external network activity and subprocess/job-control-like behavior may occur. In a persistent autonomous agent, these capabilities materially expand operational risk because they can transmit context externally or create ongoing background activity that users did not knowingly authorize.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to record facts and 'user vision verbatim' into R-RECORD artifacts creates a direct path for sensitive user-provided content to be copied into durable project files without filtering or minimization. Because this harness is persistent and resumable, verbatim capture increases the chance that secrets, personal data, or confidential business context remain stored and propagated into later phases.
- Content
Static analysis
No suspicious patterns detected.