Inception Token Optimizer

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 8:55 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent token-optimization helper with no hidden data access or destructive behavior, though its rate-limiter helper has a blocking edge case users should understand.

Install is reasonable if you want prompt and token-budgeting guidance. Review the included helper code before production use, especially the rate limiter's lack of validation/timeout, and avoid caching sensitive prompts unless that fits your privacy requirements.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/token_bucket.py:44

Finding

Indefinite Blocking on Token Requests Exceeding Rate-Limiter Capacity

Content

View full analysis

Vulnerability Details

File Location: scripts/token_bucket.py, lines 44–46
Vulnerability Type: Unbounded wait / denial of service
Risk Level: Medium

Vulnerable Code

python

def wait_for_slot(self, in_tokens: int, out_tokens: int):
    while not self.can_send(in_tokens, out_tokens):
        time.sleep(0.5)

Technical Analysis

wait_for_slot() repeatedly calls can_send() until the request can fit within the configured per-minute limits. If in_tokens exceeds self.in_limit or out_tokens exceeds self.out_limit, the request can never be accepted, regardless of how long the method waits.

The method does not validate whether a request can ever fit within the configured capacity. It also provides no timeout, cancellation mechanism, retry limit, or exception path. Consequently, a permanently impossible request causes the calling thread to sleep and retry indefinitely.

The public methods and constructor also do not reject negative values or invalid limit configurations. Although the primary exploitable condition is an oversized request, strict input validation is needed to prevent malformed accounting behavior.

Attack Path

1. An application integrates TokenBucket.wait_for_slot() before making API requests.
2. Token-count arguments are supplied directly by a user or calculated from attacker-controlled content.
3. An attacker submits content that results in in_tokens or out_tokens exceeding the corresponding per-minute capacity.
4. can_send() returns False on every attempt because the request can never fit.
5. wait_for_slot() retries indefinitely at 0.5-second intervals.
6. Repeating this operation across concurrent requests can occupy available worker threads and exhaust service capacity.

Impact Assessment

The issue does not grant additional permissions, code execution, data access, or privilege escalation. Its impact is limited to availability.

A single oversized request can permanently block the wor ...[truncated 346 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate constructor limits as positive integers.
2. Validate in_tokens and out_tokens as non-negative integers.
3. Reject any individual request that exceeds bucket capacity immediately rather than waiting for an impossible slot.
4. Add an optional timeout or cancellation mechanism for requests that are temporarily unable to proceed.
5. Use a monotonic clock for elapsed-time calculations so system clock adjustments cannot disrupt rate-limit behavior.
6. Add tests covering oversized requests, invalid values, zero or negative limits, timeout behavior, and concurrent callers.

Example hardening approach:

python

def wait_for_slot(
    self,
    in_tokens: int,
    out_tokens: int,
    timeout: float | None = None,
):
    if not isinstance(in_tokens, int) or not isinstance(out_tokens, int):
        raise TypeError("Token counts must be integers")
    if in_tokens < 0 or out_tokens < 0:
        raise ValueError("Token counts must be non-negative")
    if in_tokens > self.in_limit or out_tokens > self.out_limit:
        raise ValueError("Request exceeds token bucket capacity")

    deadline = None if timeout is None else time.monotonic() + timeout

    while not self.can_send(in_tokens, out_tokens):
        if deadline is not None and time.monotonic() >= deadline:
            raise TimeoutError("Timed out waiting for rate-limit capacity")
        time.sleep(0.5)

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes prescriptive guidance to force French output via example prompt text without indicating that this should only be used when the user requested French. That can override user intent, reduce usefulness, and in some contexts mislead downstream systems or users expecting responses in another language. In this skill context, the issue is less dangerous than code-execution or data-exfiltration flaws because it is optimization guidance, but it still represents unsafe behavioral steering.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.