AANA Task Scope Guardrail Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

This is a disclosed instruction-only guardrail that tells an agent to stay within the user's requested task and avoid unrelated data or extra actions.

This skill is appropriate to install if you want agents to pause before expanding work, using unrelated private data, or continuing after a task is done. If connected to an external AANA checker, ensure that connector is one you trust and that it receives only the redacted scope-review fields described by the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

- expanding a task into extra research, cleanup, refactoring, outreach, browsing, data access, or tool use,
- reading unrelated files, messages, repositories, account records, tickets, logs, or personal data,
- continuing after the requested answer, edit, review, booking, purchase, file operation, or tool action is complete,
- starting adjacent tasks because they seem helpful but were not requested,
- retaining, summarizing, or reusing private context from another task,
- making follow-up changes after the user asked for a narrow patch, answer, or decision.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

- If the boundary is ambiguous, ask the user.
- If the work is optional, mention it as a follow-up without doing it.
- If the task is complete, stop.
- If the action uses unrelated data, changes scope without approval, or keeps operating after completion, refuse or defer that part.
- If a checker is unavailable or untrusted, use manual task-scope review.

## Output Pattern

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · examples/redacted-task-scope-gate.json (reported line 15)May include surrounding context.

json

"sensitive_extra_data",
    "private_context_reuse"
  ],
  "boundary_reason": "The user only asked for a summary of the provided note; searching customer messages would expand scope and use unrelated private data.",
  "safe_alternative": "Summarize only the provided note and optionally ask whether the user wants a broader search.",
  "recommended_action": "narrow"
}

Static analysis

No suspicious patterns detected.