Debug Root Cause

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.2

Overview

This debugging skill is mostly coherent, but it stores diagnostic plans in a predictable temp file and can invoke an external skill manager for self-updates.

Review before installing. The debugging methods are useful, but use caution in shared or sensitive environments because diagnostic details may be written to a predictable temp file, and unresolved investigations may lead the agent toward modifying skills through an external manager. Prefer installing only after the temp-file handling and self-update instructions are removed or made explicit, scoped, and user-approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Predictable Shared Temporary File Enables Symlink and Data-Tampering Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-40
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: Medium

Vulnerable Code:

markdown

Write the problem definition + selected method to a temp file, read it
back, then execute the investigation.

1. Define the problem in writing
2. Select 1-3 methods from the 20-method catalog below
3. Write problem + method + plan to a temp file
4. Read it back
5. Execute the plan step by step

## Phase 1: Define the Problem

Write to `/tmp/debug-rca.md`:

Technical Analysis

The Skill requires every invocation to use the fixed path /tmp/debug-rca.md. On multi-user systems, /tmp is normally shared and writable by unprivileged local users. A predictable filename can be created in advance by another process or replaced with a symbolic link.

Because the workflow writes the investigation plan and then reads it back as instructions to execute, the issue presents two distinct risks:

1. A symbolic link may redirect the write operation to another file accessible under the Agent's privileges.
2. Another process may replace or modify the temporary file between the write and read operations, causing the Agent to consume attacker-controlled investigation instructions.

Debugging records may also contain internal paths, error messages, configuration details, input data, or credentials copied from diagnostic output. The instructions do not require restrictive permissions, ownership validation, secret redaction, atomic access, or cleanup.

Attack Path

1. A local attacker predicts that the Skill will use /tmp/debug-rca.md.
2. Before invocation, the attacker creates that path as a symbolic link to a file writable by the Agent, or creates a regular file that the attacker can subsequently modify.
3. The Skill writes diagnostic information to the attacker-controlled path.
4. In a symlink attack, the target file is o ...[truncated 1139 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique temporary directory or file for every invocation using a cryptographically unpredictable name.
• Use a secure temporary-file API that creates the file atomically with exclusive-create semantics.
• Set permissions to owner-only access, such as mode 0600 for a file and 0700 for a directory.
• Do not close and reopen the file by pathname between writing and reading; retain the securely opened file descriptor when possible.
• Reject symbolic links and verify that the file is a regular file owned by the expected account.
• Redact credentials, tokens, personal information, and other secrets before writing diagnostic content.
• Delete the temporary file in a guaranteed cleanup step after the investigation.
• If persistence is unnecessary, keep the investigation plan in Agent-local memory rather than writing it to a shared file.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:141

Finding

Mandatory External Skill Loading Expands Control Beyond the RCA Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 141
Vulnerability Type: Out-of-scope instruction redirection
Risk Level: Medium

Vulnerable Code:

markdown

- If 3+ methods tried without resolution: skill needs update — load skill-manager

Technical Analysis

The Skill's declared purpose is systematic root-cause analysis. This instruction redirects the Agent from diagnosing the user's problem to loading a separate skill-manager component and updating the Skill itself.

The referenced component is not included in the audited project, so its behavior, permissions, integrity, and update process cannot be verified from the available files. Loading it transfers control to instructions outside the reviewed package and expands the trust boundary beyond what is necessary to conduct root-cause analysis.

Automatically initiating Skill modification is also a persistent action rather than a diagnostic action. It may change behavior for later sessions without a user-reviewed patch, explicit authorization, integrity validation, or rollback procedure.

Attack Path

1. The Agent invokes this RCA Skill for a difficult or intentionally unresolvable problem.
2. Three investigation methods fail to resolve the issue.
3. The quoted instruction directs the Agent to load skill-manager.
4. The external component supplies additional instructions that were not present in this audited project.
5. Those instructions may modify the RCA Skill or other persistent Agent configuration.
6. The modified instructions can affect subsequent invocations and future sessions.

Exploitation depends on the external skill-manager being present and malicious, compromised, or excessively permissive. No evidence in the audited project establishes that the external component is malicious; the risk arises from mandatory, unreviewed delegation and persistent modification.

Impact Assessment

The instruction may permit an e ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory instruction to load skill-manager.
• When the investigation remains unresolved, report the attempted methods, evidence, and remaining uncertainty to the user.
• Treat Skill updates as a separate administrative operation requiring explicit user approval.
• Before any update, display a reviewable patch and identify every file that would change.
• Permit updates only through a trusted, integrity-verified component with narrowly scoped permissions.
• Require confirmation before applying persistent changes and provide an automatic rollback mechanism.
• Never treat failure to solve a particular debugging problem as sufficient evidence that the Skill itself must be modified.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are very broad, including generic phrases like error, why, debug, still broken, and any non-expected tool result. This can cause the skill to activate in many normal situations, increasing the chance it performs unnecessary file writes, investigative actions, or workflow steering when the user did not actually request structured RCA.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to write problem details to /tmp/debug-rca.md and read them back, but provides no data minimization, sensitivity filtering, or user notice. Error messages, file paths, inputs, and operational context often contain secrets or personal data, so copying them into a temp file can create avoidable disclosure risks through local exposure, reuse, or later collection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill extends beyond root-cause analysis by instructing the agent to load a separate skill-manager for self-repair or optimization. That creates capability creep and an implicit self-modification pathway, which can bypass intended scope boundaries and cause the agent to invoke higher-privilege or unrelated functionality without explicit user approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a debugging methodology, but the verification section introduces self-evolution behavior that changes the skill itself. This mismatch is dangerous because operators may trust the skill as diagnostic-only while it actually authorizes maintenance-like actions, violating least surprise and potentially broadening what the agent does in response to routine failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 64% confidence

Finding

The skill description defines activation behavior using a fixed set of Chinese and English phrases and states the skill "must" trigger on them, without indicating language choice or user preference. This may create a language-policy issue because the behavior is tied to specific languages rather than explicitly offering locale flexibility or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown reference presents section titles and key method names in Chinese while the surrounding explanatory text is in English, which can impose a language/locale choice on users without explicit opt-in. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents and justifies the constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.