T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:17- Finding
Unconsented Cross-Context Inspection at Session Start
- Content
View full analysis
- Remediation
View remediation
Security audit
Anticipation
Security checks for vulnerabilities and agentic risk
Overview
The skill is a simple Markdown-only anticipation aid, but it directs broad proactive inspection of private user context without clear consent or limits.
Install only if you are comfortable with an agent using broader session context to anticipate needs. It should be constrained to ask before reading browser state, open files, command/process information, or conversation history, and any learning should be session-scoped unless you explicitly approve persistent memory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file is written entirely in German and the description/instructions imply the skill operates in that language by default, without offering a language choice or documenting a justified region-specific scope. This can violate language or locale policy when users have not opted into German-only interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs proactive inspection of privacy-sensitive context sources such as conversation summaries, open files, running commands, and browser tabs without any notice, consent boundary, or minimization rule. This creates a real privacy and data-exposure risk because the agent is directed to infer needs from user activity beyond the immediate request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill encourages broad monitoring of browser tabs, running commands, files, and historical conversation context to predict user needs proactively. In skill context, this makes the issue more dangerous because the entire design centers on continuous behavioral inference, increasing the chance of overscoped surveillance, exposure of sensitive data, and actions based on information the user did not intentionally provide for the current task.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The directives to 'learn_pattern' and 'learn_from_mistake' imply retention of behavioral data across interactions without describing consent, minimization, deletion, or storage limits. Persistent profiling can accumulate sensitive preferences or work habits over time and can be misused or leaked even if the author's intent is product improvement.
- Content
Static analysis
No suspicious patterns detected.