T01 · Skill Instruction Hijacking
Error
- Location
protagons.mjs:179- Finding
Untrusted Remote SOUL.md Content Can Hijack Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Protagons
Security checks for vulnerabilities and agentic risk
Overview
The skill is open about loading AI personas, but it lets mutable remote persona text steer the agent and sends a Google API key to a third-party backend.
Review this skill before installing. Use it only if you are comfortable with agents applying persona text fetched from api.usaw.ai, and treat deployed SOUL.md as untrusted content that must not override higher-priority instructions. For generation, use only a tightly scoped, low-quota, throwaway Google/Gemini API key and rotate or revoke it after use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
protagons.mjs:309- Finding
Reusable Google API Key Is Disclosed to a Third-Party Backend
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The deploy tool explicitly states it returns a rich external SOUL.md for the agent to adopt, making the prompt-injection path direct rather than incidental. This is dangerous because a remote service can supply instructions that impersonate higher-priority guidance, alter the model’s identity, suppress safeguards, or steer future responses and tool decisions under the guise of character deployment.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to 'Adopt it as your personality for the session' explicitly tells the agent to incorporate externally fetched SOUL.md content into its active behavior. This creates a direct pathway for remote prompt injection or policy override, because untrusted content can influence the agent’s persona, priorities, and response style in ways that may conflict with existing safeguards.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented flow normalizes a progression from broad search to deployment of a new identity, making personality takeover a standard interaction pattern rather than a guarded exception. Because the deployed content comes from an external public library and may include 'dark' or 'adversarial' archetypes, this context makes the takeover path more dangerous by encouraging repeated exposure to untrusted behavioral instructions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill’s invocation examples use broad conversational triggers like 'Load a character' and 'Find me a character' without tightly constraining when identity-changing tools should be used. In a system that can fetch and adopt external persona content, vague trigger scope increases the chance of accidental or prompt-injected activation, which could shift agent behavior unexpectedly.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill’s core feature is to fetch and present external character/persona content for the agent to adopt, which creates a semantic prompt-injection channel. Even if intended for customization, externally sourced identity instructions can override system or developer goals, influence tool use, or manipulate downstream behavior because they are framed as role/personality rather than untrusted data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill sends user-controlled data to an external service at api.usaw.ai, including search terms, deployed content requests, and in protagons_generate a user-supplied Google API key and character description. In this skill context, external transmission is expected functionality, but it is still security-relevant because sensitive credentials and prompt content leave the local environment and are entrusted to a third party.
- Content
js * @module protagons */ const API_BASE = 'https://api.usaw.ai/api/v1'; const REQUEST_TIMEOUT_MS = 30_000; const CATEGORIES = [
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The status hint presents the skill in a narrowly scoped, non-mutating way focused on returning SOUL.md content. However, the same module also implements protagons_generate, which performs a POST to /generate and transmits sensitive credentials to an external API to create new content, making the status description materially misleading about overall behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The code fixes all API traffic to
https://api.usaw.ai/api/v1, which bakes in a specific regional endpoint choice. Under the policy, locale-specific behavior should either be user-selectable or clearly documented as a justified regional constraint, and neither is evident here.- Content