Intention Engine

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

This is a disclosed, instruction-only intent-alignment skill, but users should know it encourages using profile, memory, and project context to infer intent.

Install this only if you want your agent to use persistent context such as profile goals, recent memory, and project state when interpreting requests. For sensitive work, continue requiring explicit confirmation before irreversible, external-facing, costly, or privacy-impacting actions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26
• Finding: Overbroad Access to Persistent User and Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–34 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown ### 2. Check Intention Sources (priority order) 1. **User profile goals** — declared priorities (USER.md or equivalent) 2. **Active topic context** — what domain they're working in 3. **Recent memory** — last 2-3 days of decisions and conversation 4. **Project/task state** — what's in progress, blocked, or overdue 5. **Conversational momentum** — what they've been circling around Cross-reference at least 2 sources before inferring intention. Don't infer from a single data point. ``` ### Technical Analysis The skill instructs the agent to consult persistent user profiles, recent memory, conversational history, and project state for every non-trivial request. Because the skill is marked `user-invocable: false`, this contextual access may occur automatically rather than following an explicit invocation or consent decision. Mandatory cross-referencing of at least two sources can cause the agent to retrieve information beyond what is necessary for the current task. This conflicts with least-privilege and data-minimization principles: a clear request may not require access to `USER.md`, unrelated recent conversations, or broader project state. The reviewed files do not contain code that independently bypasses operating-system permissions. Exploitation therefore depends on the host agent already having access to these context sources. The weakness is an instruction-level expansion of access scope rather than an OS-level privilege-escalation primitive. ### Attack Path 1. The host loads the non-user-invocable skill automatically. 2. A user submits a non-trivial request, including one that is already sufficiently clear. 3. The skill directs the agent to inspect at least two contextual sources. 4. The agent reads persistent profile data, recent memory, conve ...[truncated 1048 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before accessing persistent profiles, long-term memory, or unrelated project state. 2. Replace mandatory cross-referencing with a relevance-based rule that uses additional sources only when the immediate request is materially ambiguous. 3. Prefer current-request and active-topic context before consulting persistent data. 4. Apply data minimization by retrieving only the specific fields needed to resolve the identified ambiguity. 5. Prohibit including sensitive contextual details in output unless they are necessary and the user has authorized their use. 6. Document which context sources the skill may access and provide a configuration option to disable profile or memory access. 7. Add a guard such as: “Do not read persistent memory or user-profile files when the request is already clear or when those sources are not directly relevant.” ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Don't ask "why" on every task — infer first, ask only when stuck
- Don't assume intention without checking at least 2 context sources
- Don't refuse to execute because intention is unclear — do the work, flag the gap
- Don't treat spec clarity as intention clarity — they're different failures
- Don't optimize for the stated metric without checking for unstated constraints

• Confidence: 92% confidence
• Finding: The instruction 'Don't refuse to execute because intention is unclear — do the work, flag the gap' pressures an agent to act despite unresolved intent ambiguity. In a persistent agent with access to user profile, memory, and project state, this can cause unsafe or unauthorized actions to be taken before the user’s actual objective is verified, especially for non-trivial or potentially irreversible tasks.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Anti-Patterns

- Don't ask "why" on every task — infer first, ask only when stuck
- Don't assume intention without checking at least 2 context sources
- Don't refuse to execute because intention is unclear — do the work, flag the gap
- Don't treat spec clarity as intention clarity — they're different failures
- Don't optimize for the stated metric without checking for unstated constraints

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Don't assume intention without checking at least 2 context sources
- Don't refuse to execute because intention is unclear — do the work, flag the gap
- Don't treat spec clarity as intention clarity — they're different failures
- Don't optimize for the stated metric without checking for unstated constraints

• Confidence: 85% confidence
• Finding: The anti-pattern guidance discourages checking unstated constraints only in the context of metric optimization, but elsewhere the skill repeatedly encourages redirecting execution based on inferred intention. In combination with 'infer what the user actually wants' and access to profile/memory/project context, this enables the agent to make consequential autonomous decisions from implicit signals instead of explicit authorization.

Static analysis

No suspicious patterns detected.