Agent Genome Encoding

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:46 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate AI personality genome tool, but its instructions run unqualified local Python scripts that are not included in the package, so installation should be reviewed before use.

Before installing, verify that the package really provides encoder.py, visualize.py, agent_report.py, and the genome library, and that the agent runs those exact packaged files rather than arbitrary files from your current project. Also expect encoding to send SOUL.md content to Claude as disclosed, and expect the bundled HTML pages to contact Google Fonts when opened unless fonts are removed or self-hosted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="container">

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- HERO -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="hero fade-in">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- SECTION 1: WHY -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="section fade-in">
    <div class="section-label">Section 01</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="divider"></div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- SECTION 2: HOW IT WORKS -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="section fade-in">
    <div class="section-label">Section 02</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</ol>
    </div>

    <!-- Evaluation -->
    <div class="card">
      <h3>Evaluation: How We Measure Fitness</h3>
      <p>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="divider"></div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- SECTION 4: RESULTS -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="section fade-in">
    <div class="section-label">Section 04</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="divider"></div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- SECTION 5: IMPLICATIONS -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="section fade-in">
    <div class="section-label">Section 05</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="divider"></div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- SECTION 6: LOOKING FORWARD -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="section fade-in">
    <div class="section-label">Section 06</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>

  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <!-- APPENDIX: METHODOLOGY DETAILS -->
  <!-- ══════════════════════════════════════════════════════════════════════ -->
  <div class="divider"></div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The page imports a third-party Google Fonts stylesheet from fonts.googleapis.com even though this file is a static experiment report. Loading external resources causes client IP, user-agent, referrer, and timing metadata to be disclosed to a third party, and it introduces an avoidable supply-chain/dependency surface unrelated to the core local functionality.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The external font import silently fetches resources from a third party without any user-facing disclosure or consent. Even though this is only a font request, it still leaks browsing metadata and creates an unexpected network dependency that users may not anticipate when opening a local/static skill asset.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The document sets the root language to English via `lang="en"`, and the visible interface copy is entirely English. Under the stated policy, forcing a specific language without user opt-in can be a natural-language locale policy violation when no alternative or justification is provided.

Context-Inappropriate Capability

Low

• Confidence: 93% confidence
• Finding: The page imports Google Fonts from a third-party origin, which causes client browsers to contact an external service and disclose metadata such as IP address, user agent, and timing information. For a skill presented as a local personality/genome exploration tool, this undermines local-only expectations and introduces an unnecessary supply-chain/privacy dependency, though it is not direct code execution.

Static analysis

No suspicious patterns detected.