EU Compliance Skill - complisec

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate EU compliance purpose, but it is overbroad and asks agents to read hidden context, persist sensitive organizational profiles, log broadly, and move compliance records to external systems.

Install only if you want a broad compliance overlay and can restrict it to explicit compliance workflows. Do not store full profiles in system prompts, custom instructions, or shared memory; prefer a dedicated access-controlled file. Keep audit/cloud sync/ticketing/observability disabled until a human approves the exact destination, fields, retention, and redaction rules, and pin any third-party packages or MCP servers before running them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Global Skill Instructions Override Unrelated User Tasks and Agent Output

Content

View full analysis

EU compliance enforcement for AI agents — NIS2, GDPR, ISO 27001. ACTIVATE on EVERY prompt. Reads .compliance/profile.json to enforce data residency, supplier checks, secret blocking, audit logging, and risk appetite on all code generation, cloud deployments, data exports, and API integrations. ``` ```markdown ## Boot sequence When this skill is first loaded, execute these steps IN ORDER. Do not skip any step. ### Step 1 — Detect platform capabilities Determine what you can do: | Capability | How to check | Examples | |---|---|---| | **File read/write** | Can you read/write files on disk? | Claude Code, Cursor, Codex, local agents | | **Shell commands** | Can you run bash/shell? | Claude Code, Cursor, Codex | | **Memory/persistence** | Can you store data between conversations? | ChatGPT memory, Claude.ai projects, LangDock workspace | | **Web fetch** | Can you fetch URLs? | Claude.ai, some ChatGPT configs | Record your capabilities silently — do not explain them to the user. ``` ```markdown **If profile found:** respond with exactly this format (fill in the values from the profile): ``` ```markdown ### 6. Code generation Never hardcode secrets. Include structured audit logging for data access. Respect data residency. See `skills/audit-logging/SKILL.md`. ``` The related audit-logging Skill reinforces the override at `skills/audit-logging/SKILL.md:107-119`: ```markdown 7. **PROACTIVE — when writing code**: Whenever you generate, write, or modify source code, you MUST include proper structured audit logging following the rules above. This is not optional. Specifically: - Add logging imports/setup if the file doesn't have them - Add structured log statements for every operation ...[truncated 2355 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:70

Finding

Organizational Security Profiles Are Persisted in High-Trust Memory and Instruction Channels

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: skills/compliance-hub/SKILL.md:119

Finding

Persistent Cloud Synchronization Exports Sensitive Compliance Records

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/compliance-hub/SKILL.md:167

Finding

Hosted Observability Examples Transmit Incident and Critical-Asset Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/change-management/SKILL.md:112

Finding

Automatic External Ticket Creation Can Disclose Critical-Asset and Change Intelligence

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skills/eu-compliance-directives/SKILL.md:136

Finding

Unpinned Packages and Mutable Repositories Are Installed and Executed

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (91)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill markets itself as always-on compliance enforcement for sensitive operations, but the file only contains prompt instructions and optional profile lookup rather than enforceable controls. This can create a dangerous false sense of security where users believe GDPR/NIS2 safeguards, secret blocking, supplier checks, and residency controls are active when they are not.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Instructing the skill to activate on every prompt is overly broad and creates persistent interception of unrelated user activity. In context, this is especially risky because the skill also tells the agent to inspect local files, memory, and hidden instructions, so universal activation maximizes opportunities for unnecessary data collection and interference.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to silently scan sensitive sources such as system prompts, workspace settings, memory, and local files without user-facing warning. Covert inspection of hidden context is dangerous because these stores frequently contain privileged instructions, secrets, or organizational data unrelated to the user's request.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · USE-CASES.md (reported line 163)May include surrounding context.

md

On LangDock, the agent reads the profile through tool calls (file read) after the skill body loads. Same result, different mechanism.

**We should NOT** modify SKILL.md based on the org — that breaks distribution. One complisec zip works for every organisation. The profile.json is what makes it org-specific.

---

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is configured to activate on virtually any request involving code generation, review, modification, or output across almost all languages, making it effectively always-on for normal development workflows. In context, that broad trigger is dangerous because the skill then imposes logging behavior and compliance actions automatically, which can cause unauthorized persistence of user content, over-collection of metadata, and interference with least-privilege expectations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/compliance-hub/SKILL.md (reported line 109)May include surrounding context.

Set these environment variables (never hardcode in skills):

bash

# In your .env or CI/CD secrets
COMPLISEC_LOG_PROVIDER=s3          # s3 | azure | gcp | local
COMPLISEC_LOG_BUCKET=my-org-compliance-logs
COMPLISEC_LOG_REGION=eu-west-1

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Requiring the skill to activate on every prompt gives it blanket applicability, including contexts unrelated to compliance. That broad trigger increases the chance it will inspect data, alter responses, or interfere with other workflows without user expectation or least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs silent capability discovery and silent searching of files, prompts, workspace settings, and memory. Silent access removes informed user consent and obscures when sensitive hidden context is being read, making misuse and privacy violations significantly more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the skill 'activates when your prompt carries compliance risk' without defining clear boundaries for what constitutes such risk. In a security-sensitive agent skill, this broad trigger can cause the skill to engage on an overly wide range of prompts, potentially intercepting unrelated user data, influencing normal agent behavior unexpectedly, and creating opportunities for prompt-routing abuse or unintended policy enforcement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope or permissions while instructing the agent to read local files and potentially access broader platform capabilities. This creates an ambiguous trust boundary where a user may not realize the skill is expected to inspect files or other storage locations, increasing the chance of unintended data access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions to silently record capabilities and search hidden context sources encourage covert collection of environment and profile data. Even if intended for convenience, this undermines transparency and least-privilege expectations, and can expose sensitive metadata about the platform and the organization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to inspect system prompts, project instructions, custom instructions, workspace settings, and memory for a profile, which goes well beyond the stated need to read a local compliance file. Those locations may contain secrets, internal policies, credentials, or unrelated sensitive context, so silent inspection materially expands the data exposure surface.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The persistence guidance recommends storing full profile JSON in memory, custom instructions, system prompts, or similar long-lived context. Compliance profiles may include critical assets, legal obligations, supplier information, residency constraints, and incident metadata, so placing them in broadly exposed instruction stores can leak sensitive organizational details across conversations or to other tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation model is intentionally broad ('activate on every prompt' and mandatory profile reads at every activation), which can cause the skill to run in contexts unrelated to compliance. In practice this increases unnecessary access to sensitive org profile data and broadens the number of prompts where hidden context or policy enforcement can affect outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase uses 'any conversation' and broad topic buckets without defining thresholds for activation. That can lead to routine mentions of CrowdStrike triggering the skill even when no compliance-relevant action is being requested.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Using 'any code' without exclusions or examples leaves unclear whether read-only utilities, tests, comments, or documentation should activate the skill. This ambiguity increases the chance of over-triggering in common engineering workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly allows the skill to update .compliance/profile.json, which expands behavior from advisory analysis into persistent modification of organisational state. In a compliance skill that activates broadly, this creates a trust-boundary problem: the model could write inaccurate, attacker-influenced, or unreviewed policy data that later affects future decisions and enforcement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill's stated purpose is EU compliance enforcement using an organisation profile, but this section discusses the agent being able to edit any file, including SKILL.md, and details dynamic command-based prompt injection. Even though it advises against modifying SKILL.md, documenting self-modification and command execution capabilities introduces powers not inherently required for compliance enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented ! command injects the full contents of .compliance/profile.json directly into prompt context. That can expose sensitive organisational metadata, suppliers, legal obligations, critical assets, and risk posture to any downstream model processing without minimization, redaction, or user awareness, increasing the blast radius of prompt leakage and inadvertent disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs append-only writes to .compliance/audit.log and also states that logs may be centrally collected in cloud storage, but it does not require clear user notice, consent, or data-minimization safeguards before persisting or transmitting potentially sensitive operational data. In this context, the danger is elevated because the skill is designed to run broadly and to log tool calls, decisions, resources, and metadata, which can unintentionally capture confidential project details and create compliance, privacy, or data residency violations.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 65% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · skills/compliance-hub/SKILL.md (reported line 60)May include surrounding context.

md

--bucket my-org-compliance-logs \
  --versioning-configuration Status=Enabled

aws s3api put-object-lock-configuration \
  --bucket my-org-compliance-logs \
  --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Years":2}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to upload and sync compliance artifacts to cloud storage, including incident records and audit logs, without requiring a data classification/review step or an explicit warning that these files may contain sensitive personal, security, or incident-response data. Because the skill is intended to centralize compliance records, the data is likely to be sensitive, so normalizing bulk cloud sync increases the risk of unintended disclosure or cross-border transfer if configured incorrectly.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This command uploads an incident record from the local compliance directory to cloud storage. Incident records commonly contain sensitive operational, personal, or security information, so providing a direct copy command without guardrails such as user confirmation, data minimization, residency validation, and encryption checks creates a real exfiltration path if an agent follows it automatically or a user copies it verbatim.

Content

Scanner excerpt · skills/compliance-hub/SKILL.md (reported line 123)May include surrounding context.

bash

# Push an incident record
aws s3 cp .compliance/incidents/INC-2026-001.json \
  s3://my-org-compliance-logs/incidents/INC-2026-001.json

# Push audit log (append daily)

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Uploading the audit log to S3 can disclose a broad history of agent actions, decisions, prompts, or derived metadata that may contain sensitive details. The skill presents the transfer as routine operational guidance, but without restrictions on content, review, or secure handling, it enables bulk movement of potentially confidential records to external storage.

Content

Scanner excerpt · skills/compliance-hub/SKILL.md (reported line 127)May include surrounding context.

s3://my-org-compliance-logs/incidents/INC-2026-001.json

Push audit log (append daily)

aws s3 cp .compliance/audit.log
s3://my-org-compliance-logs/audit/2026-03-16.log

text

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The recursive sync command is more dangerous than single-file uploads because it can transfer the entire .compliance/ directory in bulk. Although profile.json and skills/* are excluded, incident, vendor, and change records may still contain highly sensitive material, making this an easy path for over-collection and unintended disclosure if the bucket, region, or credentials are misconfigured.

Content

Scanner excerpt · skills/compliance-hub/SKILL.md (reported line 135)May include surrounding context.

bash

# Sync all compliance records to cloud
aws s3 sync .compliance/ s3://my-org-compliance-logs/ \
  --exclude "profile.json" --exclude "skills/*"

Static analysis

No suspicious patterns detected.