Security audit

Hizal Register Focus

Security checks for vulnerabilities and agentic risk

Overview

This skill is small and non-executable, but it automatically registers task details and enables session context injection with broad triggers and little user control.

Review this skill carefully before installing. It does not contain executable code, but it can cause task metadata and a session identifier to be registered and can bring external context into the agent's session automatically. It should only be used where the Hizal context source is trusted and where users are comfortable with automatic focus registration.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:2
Finding: Automatic External Context Injection Without Trust Controls
Content: View full analysis
", task="", tags=["", ""] ) \`\`\` ## Parameters - **session_id** — the active session's ID (from `start_session` or `get_active_session`) - **task** — a short, clear description of what you're doing (e.g., "Implement webhook signature verification for Nuvei DMNs") - **tags** — keywords that match `focus_tags` rules on context chunks. Chunks with matching rules get injected into your session automatically. ## When to Use - At session start, if the task is known - Mid-session, if the task changes significantly - After a context reset, to re-establish focus ``` ### Technical Analysis The skill directs the agent to invoke `hizal__register_focus` automatically whenever the agent identifies or changes its task. The call discloses the active session identifier, a description of the current task, and task-related tags to an unspecified integration. The integration subsequently injects matching context chunks into the active session. The skill does not define: - Authentication or authorization requirements for context-chunk publishers. - Validation or sanitization of injected content. - A rule requiring in ...[truncated 2021 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is explicitly self-triggering on very broad phrases such as 'here's what I'm doing', 'my task is', and effectively 'any time the agent articulates a specific goal'. This can cause unintended invocation during normal conversation, leading to automatic registration of task context and injection of related chunks when the user did not explicitly request the tool, which expands the attack surface for prompt/context manipulation and privacy leakage.
Content: No source excerpt is available for this finding.