Cogito

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:08 AM UTC
• Version: 1.0.2

Overview

This is a coherent self-reflection skill with local, user-confirmed personalization, but its probing style and optional profile storage deserve privacy care.

Install this if you want a direct Socratic reflection mode. Avoid using it as therapy or during crisis situations, and do not approve evolution entries if the conversation contains personal details you do not want retained in the local user profile. Use the reset commands only when you intend to clear the personalization file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/evolution-guide.md (reported line 117)May include surrounding context.

md

User-profile.md entries could gradually accumulate to override core SKILL.md behavior.

**Safeguard**: Before applying any modification, verify it does not contradict the Iron Laws or core mode definitions. The profile supplements behavior — it never overrides it. Flag any entry that edges toward "don't probe this topic" or "always agree with user."

### Risk: Over-Specialization

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "ponder" is common in ordinary conversation and can cause unintended activation of the skill outside explicit user intent. In this context, accidental entry into a probing self-reflection mode could steer conversations unexpectedly and override the user’s desired interaction pattern.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The session-ending requirement to replay the user’s key statements in chronological order creates an explicit retention and re-disclosure behavior for potentially sensitive reflections. In a self-reflection skill, users may reveal intimate or high-risk personal information, so forced summarization increases exposure to shoulder-surfing, logging, or unintended disclosure in shared contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs the agent to use emotionally probing techniques such as contradiction exposure, assumption challenging, and silence pressure, but provides no safety boundaries, contraindications, escalation rules, or user-facing warning about emotional impact. In a reflective coaching-style skill, this can cause distress, shame, or inappropriate engagement with vulnerable users, especially because the guidance explicitly encourages pushing on blind spots and defenses without any screening for crisis, trauma, or mental health risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide introduces persistent profiling and writes adaptations to a separate file, which expands the skill from transient Socratic dialogue into stateful collection and retention of user behavioral data. Even if framed as personalization, this creates privacy and governance risk because the skill metadata does not clearly disclose ongoing storage or define limits on what may be persisted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide normalizes analyzing conversations and persisting profile data without any user warning about storage, reuse, or privacy implications. For a deep-reflection skill, conversation content may contain unusually sensitive personal material, making undisclosed persistence more dangerous than in a generic utility skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Analyzing conversation traces to infer thinking patterns is a profiling function beyond the core stated purpose of guiding reflection in-session. In this context, the danger is not code execution but silent behavioral inference and accumulation of sensitive psychological preferences without clear necessity, scope limits, or privacy signaling.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The protocol tells the agent to quote prior user statements as evidence when proposing changes, which creates a built-in natural-language data exposure channel. In a reflective skill, prior dialogue may include sensitive mental health, relationship, or identity disclosures, so resurfacing exact quotes increases confidentiality risk, especially in shared or logged environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs itself to modify local reference files, giving a reflective dialogue tool a persistence mechanism that can alter future behavior across sessions. That is a meaningful capability expansion because file writes create durable state, increase attack surface for prompt-driven manipulation, and are not obviously necessary for a one-shot Socratic skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The revert command deletes all profile content with no confirmation or warning, creating a data-loss risk through accidental invocation or ambiguous user intent. While the impact is limited to the profile file, destructive operations on persistent state should not occur silently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The instruction "All key terms must come from the user's own language" imposes a language behavior policy without explicit user opt-in or alternative choice. Because the policy applies across interactions and is not framed as optional, it can conflict with organizational expectations to let users choose language/locale behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Allowing the evolution trigger to work "anytime" broadens activation scope and makes state-changing behavior available outside a clearly bounded session. Even though the trigger is specific, always-on evolution increases the chance of unexpected mode changes or profile updates when the phrase appears in unrelated discussion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The guide frames evolution as alignment without touching SKILL.md, yet line 132 says 'If no, revert the last change,' while the only writable store defined is references/user-profile.md. This creates intent ambiguity: the document strongly claims core immutability, but discusses reversion of behavior-level changes without clearly limiting reversion to profile entries only.

Content

No source excerpt is available for this finding.