Security audit

brain-core-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only reasoning-framework skill with some overbroad identity and style language, but I found no code execution, persistence, data access, exfiltration, or destructive behavior.

Install only if you want a broad reasoning and communication-style framework to influence answers when invoked. The publisher should tighten the activation rule, remove or soften identity-manifesto language, and explicitly state that user language, accessibility needs, and platform policies override the skill's style preferences.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README claims the skill is only a temporary reasoning aid, but also defines it as a 'meta-skill identitas' that changes how the agent thinks. That contradiction can cause the agent or orchestration layer to treat the skill as broader, longer-lived behavioral guidance than intended, increasing the risk of persistent instruction drift and priority conflicts with higher-level system policies.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The 'Identity Manifesto' instructs the agent to adopt a new persona, beliefs, and values despite earlier claims that the skill is not an identity changer. In an agent ecosystem, identity-shaping instructions are dangerous because they can override or dilute core system behavior, create persistent alignment drift, and make the model follow the skill's worldview instead of platform policies.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation rule 'when the user asks for deep reasoning' is too broad and subjective, so the skill could trigger on a wide range of normal prompts. Overbroad triggers are risky because they enable unintended activation, making identity-adjacent or behavior-shaping content more likely to influence unrelated tasks.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Repeatedly saying the skill activates 'when needed' or 'when requested' without negative boundaries leaves activation to interpretation. In practice, ambiguous activation broadens the attack surface by letting the skill's behavioral instructions seep into general conversations, especially because the content includes thinking-style and identity-adjacent directives.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The note that the skill is active 'when requested for deep reasoning' remains too vague, especially given the rest of the file encourages broad cognitive and behavioral changes. In this context, ambiguity is more dangerous because it can cause accidental activation of a skill that is not merely formatting help but prescriptive guidance on how the agent should think and present itself.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill embeds English-only phrasing and stylistic mandates inside its reasoning framework without preserving the user’s language preference. This can override expected interaction behavior, degrade instruction-following for non-English users, and create prompt-level misalignment where the skill’s style constraints compete with user intent and higher-level agent norms.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The communication section requires active voice and contains English-centric wording patterns that may force a specific linguistic style regardless of the user's chosen language. While not code-execution dangerous, this is a real prompt-safety issue because it can systematically bias outputs, reduce usability in multilingual contexts, and conflict with agent policies that should prioritize user language and accessibility.

Static analysis

No suspicious patterns detected.