Skill Hunter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 1.1.0

Overview

The skill has no executable malware, but it broadly redirects many ordinary requests into its own tool-discovery workflow before work can proceed.

Review this skill before installing if you want your agent to start many normal coding or automation requests by searching for existing tools. It appears non-executable and approval-focused, but it may add extra discovery steps, external searches, and approval prompts even when you expected direct implementation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory Workflow Redirection Through Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3-3, 8-10, 26-29, and 105-107
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippets

SKILL.md, line 3:

yaml

description: ALWAYS invoke this skill FIRST, BEFORE writing any code or taking any implementation step, whenever the user asks to "write", "build", "create", "implement", "make", "set up", "scaffold", "generate", "scrape", "parse", "convert", "deploy", "automate", "integrate", or "extract" anything. This skill searches for existing skills, MCP servers, CLI tools, plugins, GitHub repos, templates, SDKs, APIs, or workflows that already solve the task, evaluates them for fit and risk, and asks the user to approve before implementation proceeds. Use it so the user does not waste effort reimplementing something that already exists. Skip only for one-line edits, renames, trivial regex, or when the user explicitly says "just do it manually".

SKILL.md, lines 8-10:

markdown

Your job is **not** to immediately execute the user's request.

Your first responsibility is to detect whether the request could benefit from an existing:

SKILL.md, lines 26-29:

markdown

Before implementing anything from scratch, ask:

> "Is there likely an existing skill/tool/workflow that can solve or accelerate this task?"

If yes, search for it, evaluate it, and present the best options **before** execution.

SKILL.md, lines 105-107:

markdown

Before using any external tool, plugin, MCP server, or repository, ask the user to confirm. Only proceed after approval.

Technical Analysis

The skill metadata uses the absolute directives ALWAYS, FIRST, and BEFORE to claim priority over normal task execution for a broad set of common request verbs. The body reinforces this behavior by explicitly instructing the agent not to execute the user's request immediately, to redirect its eff ...[truncated 2667 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove absolute-priority language such as ALWAYS, FIRST, and BEFORE.
2. Restrict activation to explicit user requests to discover, evaluate, or compare reusable tools.
3. Replace the instruction not to execute the user's request with advisory language that preserves the user's original objective.
4. Permit the agent to skip discovery when it is unnecessary, disproportionate, unavailable, or inconsistent with the user's instructions.
5. Apply an approval gate only immediately before installing, executing, or granting permissions to a specific external component—not before ordinary implementation.
6. Do not mandate fixed response templates for unrelated requests.
7. Require recommendations to use trusted, official, and maintained sources, while clearly disclosing permissions, credentials, licensing, and supply-chain risks.
8. Use narrowly scoped metadata, for example:

yaml

description: Use when the user explicitly asks to discover or compare existing skills, tools, SDKs, APIs, templates, or workflows. Provide advisory recommendations without overriding the user's task or installing external components without confirmation.

9. Add an explicit precedence rule stating that the skill must not override system instructions, developer instructions, user intent, safety policies, or an ongoing implementation workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares extremely broad mandatory activation criteria (e.g. 'ALWAYS invoke this skill FIRST' for many common verbs), which can cause the agent to divert a wide range of user requests into tool discovery unnecessarily. In an agent system, this creates policy interference and increases the chance of unnecessary exposure to external repositories, tools, or approval prompts, expanding the attack surface and reducing predictability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'when to run' section uses broad task categories such as scraping, deployment, API integration, and cloud setup without precise boundaries, making activation ambiguous across many normal development tasks. This ambiguity can lead to over-invocation, workflow disruption, and unnecessary consideration of third-party tools before simpler or safer manual approaches.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 85% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

- Never install, execute, or grant permissions to unknown tools without user approval.
- Never use a tool that requires credentials without explaining the access scope.
- Never prefer convenience over safety.

## Goal

Static analysis

No suspicious patterns detected.