Security audit

awakening-protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is an identity onboarding workflow, but it can create and later mutate persistent agent behavior files with broad triggers and limited safeguards.

Install only in a workspace where persistent agent identity files are intended. Review generated SOUL.md, SELF.md, and USER.md carefully before saving, avoid placing tool permissions or safety-policy changes in them, and back up BOOTSTRAP.md because the skill instructs the agent to delete it after onboarding.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:21
Finding: Persistent Behavioral Instruction Injection Through Identity Onboarding
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/SOUL-TEMPLATE.md:27
Finding: Autonomous Long-Term Memory and Identity Mutation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:105
Finding: Bootstrap File Deleted Without Separate Confirmation or Recovery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description uses broad phrases like "awakening", "onboarding", "first start", and "etc.", which makes activation criteria under-specified and prone to accidental invocation from ordinary conversation. In an agent skill that writes identity/configuration files, unintended activation can cause unauthorized or confusing state changes even without malicious intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file-based conditions "BOOTSTRAP.md exists" or "SOUL.md doesn't exist" are ambiguous because they can be satisfied in normal repository states unrelated to user intent. Since the skill proceeds to generate and later delete files, unintended invocation could overwrite identity artifacts or remove BOOTSTRAP.md based solely on environmental state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction "Switch to English if user responds in English" enforces a language behavior automatically rather than offering the user a choice. This is a natural-language policy issue because it assumes the preferred interaction language based solely on one response instead of asking or allowing opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.