T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:26- Finding
Overbroad Access to Persistent User and Agent Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Intention Engine
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed, instruction-only intent-alignment skill, but users should know it encourages using profile, memory, and project context to infer intent.
Install this only if you want your agent to use persistent context such as profile goals, recent memory, and project state when interpreting requests. For sensitive work, continue requiring explicit confirmation before irreversible, external-facing, costly, or privacy-impacting actions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 92% confidence
- Finding
The instruction 'Don't refuse to execute because intention is unclear — do the work, flag the gap' pressures an agent to act despite unresolved intent ambiguity. In a persistent agent with access to user profile, memory, and project state, this can cause unsafe or unauthorized actions to be taken before the user’s actual objective is verified, especially for non-trivial or potentially irreversible tasks.
- Content
md - Don't ask "why" on every task — infer first, ask only when stuck - Don't assume intention without checking at least 2 context sources - Don't refuse to execute because intention is unclear — do the work, flag the gap - Don't treat spec clarity as intention clarity — they're different failures - Don't optimize for the stated metric without checking for unstated constraints
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Anti-Patterns - Don't ask "why" on every task — infer first, ask only when stuck - Don't assume intention without checking at least 2 context sources - Don't refuse to execute because intention is unclear — do the work, flag the gap - Don't treat spec clarity as intention clarity — they're different failures - Don't optimize for the stated metric without checking for unstated constraints
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The anti-pattern guidance discourages checking unstated constraints only in the context of metric optimization, but elsewhere the skill repeatedly encourages redirecting execution based on inferred intention. In combination with 'infer what the user actually wants' and access to profile/memory/project context, this enables the agent to make consequential autonomous decisions from implicit signals instead of explicit authorization.
- Content
md - Don't assume intention without checking at least 2 context sources - Don't refuse to execute because intention is unclear — do the work, flag the gap - Don't treat spec clarity as intention clarity — they're different failures - Don't optimize for the stated metric without checking for unstated constraints