Context Scope Tags

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:14 PM UTC
• Version: 0.2.0

Overview

This is a small markdown-only chat-tag guide that discloses its memory behavior and does not add code, credentials, network access, or hidden execution.

This skill is reasonable to install if you want explicit chat context and memory-intent tags. Be aware that [REM] is meant to request durable memory when your agent supports it, so only use that tag for preferences or decisions you actually want remembered.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

ing][NOMEM] Draft 5 ad angles for OpenClaw; don't store memory.`
- `[SCOPE: openclaw-mem] Explain why lane A is failing; keep it scoped.`
- `[GLOBAL][REM] Remember: display times in Asia/Taipei unless I say otherwise.`

## Quick start

1) Put one or more tags at the **very start** of your message.
2) Prefer this order: **scope tag(s)** then **memory tag(s)**.
3) Write normally.

Optional: if your assistant supports command-style shortcuts, `/ctx` or `/context_def` can print this cheat sheet.

## Tag parsing rules

- Tags must appear **at the start** of the user's message.
- Multiple tags are allowed.
- Tags do **not** override safety policies, tool access controls, approvals, or platform rules.

### Conflicting tags

Some combinations conflict (for example `[ISO]` + `[GLOBAL]`, or `[REM]` + `[NOMEM]`).

Recommended policy:
- **Last tag wins** for the conflicting dimension.
- If the combination is ambiguous, **ask a clarifying question** rather than guessing.

## Supported tags

### Iso

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Tags must appear **at the start** of the user's message.
- Multiple tags are allowed.
- Tags do **not** override safety policies, tool access controls, approvals, or platform rules.

### Conflicting tags

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Tags must appear **at the start** of the user's message.
- Multiple tags are allowed.
- Tags do **not** override safety policies, tool access controls, approvals, or platform rules.

### Conflicting tags

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- `[ISO: <topic>]` / `[Isolated Context: <topic>]`
  - Treat as a **fresh topic**.
  - Do **not** pull in other conversation/project context unless the user explicitly re-provides it.
  - Allowed implicit carry-over: universal safety rules + a few stable user prefs (timezone, "don't apply changes without approval", etc.).

- `[SCOPE: <topic>]` / `[Scoped Context: <topic>]`
  - Restrict reasoning to the named scope.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The example instructs the assistant to remember and apply a specific locale/timezone preference, 'Asia/Taipei unless I say otherwise.' This is natural-language policy-relevant because it normalizes forcing a locale setting as persisted behavior without documenting opt-in controls or a region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.