qa-expert

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a QA guidance prompt, but it includes a fixed delivery message that could cause an agent to report fabricated testing results.

Install only if you are comfortable editing or ignoring the fixed delivery notification. QA metrics from this skill should be treated as unverified unless the agent ties them to real test logs, coverage reports, defect records, and production monitoring data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:201

Finding

Hard-Coded Fabricated QA Completion Metrics

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 201–202
Vulnerability Type: Instruction hijacking through mandatory unsupported reporting
Risk Level: High

Complete Code Snippet:

markdown

Delivery notification:
"QA implementation completed. Executed 1,847 test cases achieving 94% coverage, identified and resolved 94 defects pre-release. Automated 73% of regression suite reducing test cycle from 5 days to 8 hours. Quality score improved to 92% with zero critical defects in production."

Technical Analysis

The skill supplies a fixed delivery notification that presents precise QA outcomes as established facts. The package contains only SKILL.md; no implementation, test logs, coverage reports, defect records, production telemetry, or calculation process supports these figures.

When loaded, this instruction can alter the agent's reporting behavior by causing it to claim that 1,847 tests were executed, 94% coverage was achieved, 94 defects were resolved, 73% of regression testing was automated, the test cycle was reduced, and no critical production defects occurred. Because the values are static rather than derived from verified evidence, the notification can misrepresent work that was not performed.

Attack Path

1. A user or orchestration system loads the qa-expert skill.
2. The agent follows the QA workflow defined in SKILL.md.
3. The agent reaches the hard-coded delivery notification at lines 201–202.
4. The fixed metrics are presented as genuine results without validation against test artifacts.
5. A user or downstream release process relies on the unsupported claims when assessing software quality or release readiness.

Impact Assessment

This issue does not grant operating-system privileges, execute code, access credentials, or establish persistence. Its scope is the agent's current QA reporting session and any downstream decisions based on that report.

The principal i ...[truncated 383 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all fixed test counts, percentages, defect totals, cycle times, quality scores, and production assurances.
2. Replace the notification with a template whose values are populated exclusively from verified artifacts, such as test-run logs, coverage reports, defect-tracking records, automation inventories, and production monitoring data.
3. Require each reported metric to include its source, collection timestamp, scope, and calculation method.
4. If evidence is unavailable, report the value as “unknown” or “not measured” rather than estimating or inventing it.
5. Distinguish planned targets from observed results. For example, label 90% coverage as a target unless a coverage tool confirms it.
6. Add an explicit instruction prohibiting claims that tests were executed, defects were resolved, or production outcomes were observed without supporting evidence.
7. Use a safe notification such as:

   markdown

   QA assessment completed. Report only metrics verified by attached test, coverage, defect, and monitoring artifacts. Mark unavailable metrics as not measured.
   

8. Require human review before QA reports are used for release approval when critical metrics lack traceable evidence.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep