Back to skill

Security audit

Tutur Gayo

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow Bahasa Gayo writing and review skill with no executable code, persistence, credential handling, or hidden high-impact behavior.

Install this if you specifically want cautious Bahasa Gayo drafting or review. For formal, legal, ritual, educational, or public-facing text, still have a competent speaker or relevant language authority review the output.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default prompt instructs the skill to adapt text into 'Bahasa Gayo regional register' as a fixed behavior. This is a natural-language locale policy concern because it imposes a specific language/register choice without indicating user selection, opt-in, or an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file states 'Language/register: Bahasa Gayo' as a fixed requirement, which can be read as forcing a specific language/locale. Although the document is region-specific, it does not explicitly say the user can choose another language or opt into Gayo output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file explicitly sets "Language: Gayo" and a specific regional context, which imposes a language/locale constraint in natural-language content. Under the policy, locale restrictions should either offer user choice or be clearly documented as a justified region-specific constraint; this file does not state that the language is optional or user-selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The sample tasks direct the skill toward producing Gayo or Indonesian-Gayo output, which imposes a specific language/locale behavior. The file does not explicitly state that the user can choose another language or opt in to this locale constraint, so it risks violating the language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description says to use the skill when the user asks for Bahasa Gayo or related adaptation, which is generally appropriate, but it frames output around a specific language/locale without explicitly stating that the user can choose another language for explanations or responses. Because this is a language-focused skill, the risk is limited, but the file does not clearly offer a language-choice fallback.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction 'Produce the message in Indonesian first' imposes a specific language choice as the default response behavior. Under the policy, language constraints should either be optional, user-selected, or clearly justified as region-specific; this file does not present it as an opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file states the skill's purpose is to support generation and review specifically for Bahasa Gayo, which constrains language behavior to a particular locale/domain. Because the document does not explicitly frame this as user-selected or optional within the skill text, it can be read as a fixed language policy.

Content

No source excerpt is available for this finding.