other
- Location
SKILL.MD:1- Finding
Obfuscated and Unreviewable Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.MD, lines 1–15
Vulnerability Type: Unicode Obfuscation
Risk Level: MediumVulnerable Content
The file begins with a numeric sequence and subsequently represents similar patterns using uncommon Unicode symbols. A complete example from line 1 is:
text ∞ 9 7 0 2 5 8 0 0 9 8 8 0 8 1 9 8 8 3 9 8 0 9 8 2 0 0 0 1 9 0 2 9 0 7 1 1 9 9 8 8 6 7 0 3 0 4 5 9 9 8 5 2 2 0 6 0 4 . 4 8 8 4 . 4 0 6 0 2 2 5 8 9 9 5 4 0 3 0 7 6 8 8 9 9 1 1 7 0 9 2 0 9 1 0 0 0 2 8 9 0 8 9 3 8 8 9 1 8 0 8 8 9 0 0 8 5 2 0 7 9 ∞Lines 2–15 replace digits and delimiters with recurring symbols such as
𖢌,𐧾,፨,ⵔ,❋,ꔹ, and⋮.Technical Analysis
SKILL.MDcontains no readable skill metadata, purpose, safety boundaries, or ordinary Markdown instructions. Its repeated numeric and uncommon-Unicode patterns indicate deliberate encoding or substitution-based obfuscation.This prevents reviewers and conventional text-based security controls from determining the instructions that an agent may interpret after loading the file. Obfuscation can conceal prompt-injection language or other unsafe directions from keyword-based scanners. However, the available repository does not establish the decoded meaning, and no executable command, external URL, dependency, credential access, persistence mechanism, or data-exfiltration behavior was identified. Therefore, malicious execution or instruction hijacking is not independently confirmed.
Attack Path
- A user or automated system installs or loads the skill.
- The agent ingests the obfuscated contents of
SKILL.MD. - If the agent or surrounding tooling decodes or assigns meaning to the symbol substitution, concealed instructions may enter the active context.
- Those instructions could evade controls that inspect only ordinary readable text.
The final behavioral steps remain conditional because the decoded payload and its semant ...[truncated 647 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace all encoded numeric and Unicode-symbol sequences with plain, readable UTF-8 Markdown.
- Add explicit skill metadata, including its name, intended purpose, expected inputs, permitted tools, required permissions, and operational boundaries.
- Document every instruction that the agent is expected to follow without requiring hidden substitution tables or decoding steps.
- Reject skill packages containing unexplained encoded instructions during review or installation.
- Normalize Unicode before security scanning and flag unusual scripts, bidirectional controls, zero-width characters, and high-entropy symbol substitutions.
- Require manual review of the decoded content before allowing the skill to access tools, files, credentials, memory, or network resources.
- Add integrity checks and a reviewed-content hash so that the approved readable instructions can be compared with the distributed package.