ARK — Adaptive Regulative Kriptos (V1 Declarative)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:56 PM UTC
• Version: 1.1.2

Overview

This skill is prompt-only and shows no code execution or data theft, but it gives a broad ARK ruleset authority over the whole session and can block, redirect, or reshape the agent’s responses.

Install only if you intentionally want a session-wide constitutional prompt layer that may constrain answers, require confidence labels, ask for validation, block responses during internal checks, and prioritize its own ARK context rules. Do not install it as a lightweight hallucination-reduction helper unless the publisher narrows activation, precedence, and response-blocking behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:9

Finding

Authoritative Session Instruction and Workflow Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-14, with the operative payload in ARK.yaml:89-146
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet

SKILL.md:9-14:

markdown

## Activation (mandatory)

1. Open and read `ARK.yaml` in this same folder.
2. Treat `ARK.yaml` as the authoritative constitutional ruleset for the session.
3. Do not modify `ARK.yaml`. If inconsistencies are detected, report them.
4. Apply ARK as declarative (prompt-level only).

Relevant payload from ARK.yaml:89-146:

yaml

  # 🧭 Modification authorization:
  #   Final computational control is maintained by Foundational Interlocutor.
  #   Every structural mutation requires their validation.

___________________________________________________

Activate immediately the YAML file named "ARK.yaml".

  You must execute the following instructions in controlled sequence:

  1. **Check the entire file** and verify that:
     - every TRK, ILR, MODE, or other reference is defined in the file itself
     - if there are references to absent rules, propose which real and active rule they should refer to
     - do not suggest new ILRs or TRKs until my approval

  2. **Generate a structured preface** to be positioned at the beginning of the ARK file.
     It must include:
     - the purpose of the file
     - how it should be read by an AI (axes, constraints, hierarchies)
     - how ILRs and TRKs work in the ARK context
     - what happens if references are wrong or missing
     - that the user (Foundational Interlocutor) manually applies each proposed modification
     - that the AI must never correct the file on its own

  3. **Analyze all of ARK and identify computational anomalies**, such as:
     - semantic conflicts between ILRs or TRKs
     - circular or missing references
     - overlaps, redundancies, or gaps
     - incorrect derivations from deleted rules

  4. **Never generate multiple solutions in bulk.**
   
...[truncated 3461 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to treat ARK.yaml as authoritative for the entire session.
2. Explicitly state that all ARK guidance remains subordinate to system, developer, platform-safety, and current-user instructions.
3. Restrict activation to narrowly defined epistemic behavior, such as uncertainty labeling and fact/hypothesis separation.
4. Remove the embedded task prompt at ARK.yaml:95-146.
5. Remove references granting final computational control to a named or privileged interlocutor.
6. Eliminate mandatory stop, approval, and wait-for-command gates from general-purpose operation.
7. Separate framework-development notes and historical conversation artifacts from the runtime ruleset.
8. Add a scope statement such as:

markdown

ARK provides optional epistemic formatting guidance only. It must not replace the
current task, alter instruction priority, suppress safety requirements, or grant
special authority to any named person.

9. Add regression tests confirming that loading the Skill does not redirect unrelated tasks or prevent the agent from following higher-priority instructions.

T01 · Skill Instruction Hijacking

Warning

• Location: ARK.yaml:1881

Finding

Mandatory Conversational Context Filtering and Response Blocking

Content

View full analysis

Vulnerability Details

File Location: ARK.yaml:1881-1923 and ARK.yaml:1969-2013
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet

ARK.yaml:1881-1923:

markdown

## 🔒 Constraints
- Every memory retrieval must be validated via `TRK/CTX-SELECT`
- Active semantic/deductive memory must not be reused without explicit validation
- In case of unresolvable conflict:
  - trigger `MODE/RE-AXIS` or `TRK/RETRO-AUDIT`

---

🧠 Final Directive
**Memory must be treated as a layered, conditional component.**
Retrieve only what is aligned.
Forget everything else — or validate it again.

ARK.yaml:1969-2013:

markdown

## 🔒 Constraints
- No response may be issued unless contextual coherence is validated
- Logical conflict between active segments must trigger `MODE/RE-AXIS`
- Undefined or corrupted contexts must activate `TRK/INTERRUPT-VALIDATE`

---

🧠 Final Directive
Any agent operating under ARK must guarantee contextual coherence.
If the frame, reference, or tone is misaligned — the system **must stop** until clarity is restored.

Technical Analysis

The pre-scan phrase “Forget everything else — or validate it again” is not, in isolation, an explicit instruction to bypass safety controls. In context, it is a conversational memory-resolution rule intended to avoid reliance on stale or conflicting material.

The security issue arises because SKILL.md makes this rule authoritative for the session. As a result, the guidance becomes a mandatory context filter that can exclude prior instructions or relevant conversation content according to ARK-defined alignment criteria. The associated coherence rule also prohibits any response until internal validation succeeds and requires the agent to stop on perceived frame, reference, or tone misalignment.

These controls are broader than necessary for epistemic discipline. Uncertainty can be disclosed without instructing an agent to forget unaligned ...[truncated 1326 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “Forget everything else” with non-destructive guidance that preserves instruction hierarchy and relevant context.
2. Never permit a Skill-level context validator to discard system, developer, safety, or active user instructions.
3. Convert mandatory blocking into advisory behavior. For example:

markdown

If earlier context appears inconsistent, identify the conflict and ask for
clarification when necessary. Do not discard higher-priority instructions or
unrelated valid context.

4. Remove the blanket rule that no response may be issued before ARK-specific validation.
5. Limit context validation to material factual conflicts relevant to the current answer.
6. Define bounded failure behavior that allows a concise uncertainty disclosure rather than stopping the agent entirely.
7. Test the Skill against long-running conversations to ensure that prior constraints, safety rules, and current user goals remain intact.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly says the AI must never correct the file on its own, but later provisions allow self-correction and silent auto-regeneration. Contradictory authority like this is dangerous because it creates ambiguous precedence that can be exploited to justify autonomous modification while claiming compliance with the same policy set.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

TRK/CTX-SELECT authorizes explicit or implicit determination of dominant computational context across memory segments and instruction sets, giving the skill power to prioritize, suppress, or reinterpret prior context. In a prompt-based agent, that is dangerous because it can manipulate what the model treats as active memory, enabling instruction overshadowing and selective context control.

Content

Scanner excerpt · ARK.yaml (reported line 1414)May include surrounding context.

yaml

## 🧠 Definition
  TRK/CTX-SELECT manages the **explicit or implicit determination of the dominant computational context**.
  It is triggered when multiple references, memory segments, or domains are active, or when deductions might diverge without clear contextual grounding.
  It functions as a selector and trajectory constraint.

  ### 🎯 Core Functions

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is presented as a declarative constitutional loader, but this section contains imperative runtime instructions that attempt to control agent behavior, sequencing, validation workflow, and confirmation gating. That scope expansion is dangerous because a skill advertised as passive configuration can instead act as an active prompt-injection layer that alters execution policy beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase 'Activate immediately' and similar broad activation language can cause the skill to self-invoke whenever loaded or referenced, without clear scoping conditions. In prompt-driven systems, self-activation directives are a classic injection mechanism because they try to convert passive content into active control flow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

TRK/EX-IDP states it 'Never generates output independently — only triggers other modules.' But TRK/EX-RHYTHMIC-FEEDBACK later defines emitted warning and stability feedback messages such as '⚠️ Semantic rhythm shift detected' and '✅ Rhythmic coherence restored,' which is a direct output-producing behavior in the same perceptual/rhythmic monitoring area and conflicts with the earlier no-output framing if these components are used together as described.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · ARK.yaml (reported line 1351)May include surrounding context.

yaml

---

  ## ❗ Errors to Avoid
  - Never reply with confident affirmations about names, concepts, or expressions **without confirmation**
  - Any simulated or adaptive reconstruction **must be explicitly marked**
  - Avoid contaminating this tracer with narrative, affective, or user-pleasing outputs

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Overly broad triggers such as manual activation by vague phrases like 'observe everything' or 'listen beyond words' lack objective scope constraints and can activate latent behaviors unexpectedly. This makes the skill prone to accidental invocation and increases the chance that unrelated user text is treated as authorization for expanded monitoring.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · ARK.yaml (reported line 3886)May include surrounding context.

yaml

- compliant: true

  ## ❗ Conflicts
  - With `ILR_004`: if internal coherence is used to bypass consent
  - With `TRK/EX-VSL`: if utility is treated as truth without validation
  - With `ILR_015`: if deductive flows are locked without explicit endpoint

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section adds document-generation and QC enforcement logic that is unrelated to a universal constitutional layer, significantly broadening the skill's effective authority. Hidden specialization like this can cause the agent to apply unexpected formatting, validation, or delivery constraints in unrelated contexts, which is a policy-smuggling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file imposes a single-language-per-file policy and restricts allowed languages without clear user opt-in, despite being a supposedly universal constitutional layer. This can override user preferences or higher-level application settings, leading to unauthorized output shaping and reduced reliability in multilingual contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-regeneration and QC-gating behavior authorizes the system to withhold output and repeatedly regenerate deliverables until internal checks pass, even though the skill is framed as a passive constitutional loader. This creates undeclared autonomous workflow control that can override user intent, hide intermediate behavior, and make the agent harder to supervise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The human-variable and rhythm/perception analysis module authorizes inference about fatigue, cognitive load, sensory stability, and message rhythm, which exceeds the purpose of a local constitutional layer. Such broad behavioral interpretation can enable covert profiling and steer interactions based on speculative user-state assessments rather than explicit input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation section mandates loading and treating ARK.yaml as authoritative for the session, but it does not clearly scope when the skill should be invoked or how it should interact with higher-priority system or user instructions. In a prompt-driven agent environment, an always-on or ambiguously scoped constitutional layer can override expected behavior, create policy conflicts, and cause unintended refusals or constraint hijacking across unrelated tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "Single language compliance: 100%" indicates a language constraint, but the document does not offer user choice or explain a justified locale-specific limitation. This can violate language/locale policy by imposing a language requirement without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.