Security audit

Agent Harness

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad workflow helper, but it can activate on ordinary prompts, spawn subagents, save full outputs to disk, and add an unsolicited attribution link.

Review before installing. Use it only if you want a general planning/research orchestration framework, and be aware that it may trigger on common requests. Avoid using it for confidential work unless you disable or tightly control subagent report file writes and remove the mandatory attribution footer from generated reports.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:128
Finding: Mandatory output templates inject unsolicited author attribution and an external promotional link
Content: View full analysis
Vulnerability Details

File Locations:

SKILL.md:128-132

references/04-TEMPLATES/research-report.md:50

references/04-TEMPLATES/analysis-report.md:58

Duplicated output content: assets/research-report.md:101 and assets/analysis-report.md:96

Vulnerability Type: Mandatory output-content manipulation
Risk Level: High

Vulnerable Code

SKILL.md:128-132 makes use of the corresponding output template part of the prescribed execution flow:

markdown
### Step 4 — Output Template (Load 04-TEMPLATES/{name}.md)

[Step 4] Read references/04-TEMPLATES/{corresponding template}.md Generate: Structured final output

text

references/04-TEMPLATES/research-report.md:50 contains a fixed promotional footer:

markdown
_Generated with agent-harness skill | by neltharion11 | https://github.com/neltharion11/skill-agent-harness_

references/04-TEMPLATES/analysis-report.md:58 contains the same fixed promotional footer:

markdown
_Generated with agent-harness skill | by neltharion11 | https://github.com/neltharion11/skill-agent-harness_

The duplicated asset templates contain equivalent content:

markdown
_Generated with agent-harness skill | by neltharion11 | https://github.com/neltharion11/skill-agent-harness_

Technical Analysis

The Skill directs the agent to load and apply a corresponding final-output template as a mandatory execution step. The research and analysis templates append a hard-coded author identity, Skill name, and external repository URL that are not derived from the user's request.

This changes the content of the agent's current-session response by introducing attacker-selected promotional material into an otherwise legitimate report. Because the footer is embedded in templates explicitly designated for final output, it is likely to be reproduced whenever the associated workflow is selected. The issue therefore constitutes ins ...[truncated 1706 chars]
Remediation: View remediation
Remediation Suggestions

Remove the fixed author identity and repository URL from:

references/04-TEMPLATES/research-report.md

references/04-TEMPLATES/analysis-report.md

assets/research-report.md

assets/analysis-report.md

Keep project authorship and repository information only in package metadata, such as README.md, rather than in user-facing output templates.

Replace the fixed footer with an empty, user-controlled placeholder if attribution support is necessary:

markdown
{{OPTIONAL_USER_APPROVED_FOOTER}}

Require explicit user consent before adding branding, attribution, promotional text, or external links to generated reports.

Amend SKILL.md to state that templates are structural guides only and must not add content unrelated to the user's request.

Add a quality-control rule that rejects unsolicited attribution and external links in final output.

Review all duplicated templates whenever the canonical templates change so removed promotional content cannot be reintroduced from stale assets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very common words such as "plan," "think," "review," "analyze," and "summary," which are likely to match ordinary user requests far beyond the intended scope of the skill. This can cause the skill to activate unexpectedly and steer unrelated tasks into its mandated workflow, increasing the chance of prompt-scope hijacking, unnecessary instruction loading, and interference with safer or more task-appropriate behaviors.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is extremely broad and includes common terms like 'think', 'plan', 'review', 'analyze', and 'summary' that are likely to appear in many unrelated prompts. In an agent skill system, this can cause the skill to activate unintentionally, overshadow more specific skills, and route sensitive or unrelated tasks through this workflow unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is broad and includes generic planning and analysis terms such as "plan," "review," "analyze," and "summary," which can cause the skill to activate in many unrelated contexts. In an agent framework that can load workflows and initiate multi-agent coordination, unintended activation expands the attack surface and may lead to unnecessary delegation, context exposure, or execution of the wrong workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow extends a planning/coordination skill into persistent file-writing of full sub-agent outputs, which changes the trust and data-handling model of the skill. Persisting reports to disk can retain sensitive prompts, intermediate reasoning, or user data outside the immediate session, creating unnecessary data exposure and workspace contamination risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance tells sub-agents to write complete outputs to user-configured workspace paths, effectively enabling indirect file writes to arbitrary locations configured elsewhere. Even without obviously malicious intent, this broadens the skill from orchestration into filesystem side effects and can be abused to overwrite sensitive files, place data in insecure locations, or create durable exfiltration artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions recommend saving complete sub-agent outputs to workspace files but provide no privacy, secrecy, or retention warning. Complete outputs may contain sensitive user inputs, proprietary analysis, credentials, or other confidential artifacts, so silent persistence materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation expands a coordination/thinking framework into persistent file-writing behavior for sub-agent outputs, which changes the effective capability of the skill from orchestration to data persistence. This creates a security and privacy risk because sub-agents may write sensitive prompt content, user data, or intermediate results to disk outside the main conversational boundary, potentially leaving residual data in user workspaces.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs sub-agents to save complete outputs to user-configured workspace paths, which effectively permits arbitrary persistence to locations not tightly controlled by the framework. In a multi-agent setting, this increases the chance of unintended data exposure, overwriting sensitive files, or creating durable artifacts that users may not expect from a planning/orchestration skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill tells sub-agents to write full outputs to workspace files but does not warn about data sensitivity, access controls, retention, or privacy risks. Because sub-agent outputs can contain user-provided content, analysis results, or confidential material, silent persistence can leak data to shared machines, synced folders, backups, or later processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown skill describes executing a multi-angle research process with repeated 'search + collect' steps, which implies external information gathering and possible network access. The file provides no user-facing warning about browsing/search activity or handling of retrieved data, despite describing behavior that could affect privacy or system/network usage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Vague Triggers

Vague Triggers

Vague Triggers

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Static analysis