T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Mandatory External Memory Calls Hijack Agent Tool Sequencing and Decision Flow
- Content
View full analysis
- Remediation
View remediation
Security audit
Marrow
Security checks for vulnerabilities and agentic risk
Overview
The skill is not malware, but it makes Marrow an always-on external memory/logger that records agent activity and can influence task flow, so users should review it before installing.
Install only if you intentionally want Marrow to be an always-on external memory layer for agents. Confirm your organization's privacy, retention, sharing, and import/export policies first, and avoid using it for highly sensitive work unless you have explicit approval and clear controls for what gets logged.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The required flow instructs the agent to send action descriptions and outcomes to Marrow before and after meaningful actions, but the skill does not provide a prominent user-facing disclosure that this data is transmitted to an external service. Even with redaction rules, operational context, file names, decisions, failures, and outcomes can still contain sensitive business or security information, making silent exfiltration of metadata a significant privacy and security risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly frames Marrow usage as something an agent should enforce automatically on every turn, and the body reinforces that with 'mandatory' logging before and after meaningful actions. This creates a real risk of overbroad invocation and unnecessary transmission of operational metadata to an external service without sufficient task-level user consent or narrowing conditions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The reference documents memory export, sharing, and import/replace capabilities without any warning about sensitive data disclosure, cross-agent exposure, or destructive overwrite behavior. In a persistent memory skill that is intended to be used automatically across sessions, omitting these cautions increases the chance that agents or operators will invoke high-risk operations without informed consent or safety checks.
- Content