euthyna (English)

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 7:09 PM UTC
• Version: 0.4.2

Overview

The skill is a disclosed security-audit workflow that may run local measurement commands and write audit reports, with no evidence of hidden or malicious behavior.

Install this if you want a strict security-audit process. Before using it, be prepared for local repository reads, git/history and coverage commands, possible dependency metadata lookups, and a report file being created. For PoCs, reproduce commands, test execution, or CLI installation, review the exact commands and output location first, especially on sensitive repositories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation says the skill 'does not find bugs' and 'only polices conclusions', suggesting a narrowly scoped adjudication role. However, the same file directs the agent to run audit/history/coverage commands, optionally re-run reproduce commands with `--verify`, and mandatorily write a report file to disk, which is materially broader operational behavior than pure adjudication.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| **logic defect** | default to **not a false positive**. "Logic defects pass every boundary check" — **do not let clean static analysis convince you it is a false positive** |
| remaining classes | see below, class by class |

Flip these two rows and you flood memory corruption with false positives while missing real logic-defect vulnerabilities.

---

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The manifest describes three functions centered on fact supply and claim adjudication, which reads like an analysis and gating tool. Later instructions require that the report be written to disk with fallback locations including desktop and temp directories, which is an additional persistence behavior not conveyed by the manifest description.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file explicitly requires persisting output to disk: 'It must be written to disk.' That is a file-writing behavior, but the description does not warn about where the file should be written, avoiding overwrites, or that local data will be created and retained.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The style guidance mandates specific wording conventions such as 'no person' and prescribes exact phrasing for reports, but it does not present these as optional or context-dependent. This can amount to a natural-language policy constraint if the broader environment expects user choice over report language/style rather than a forced convention.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The file explicitly requires the agent to write a report to disk and treats chat-only output as failure, but it does not require prior user consent before modifying the local filesystem. In an agent setting, mandatory file writes can create unauthorized local side effects, surprise the user, and increase risk when combined with broad filesystem access, even if the stated purpose is operational reliability rather than harm.

Static analysis

No suspicious patterns detected.