Luxury Fraud Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:16 PM UTC
• Version: 0.1.0

Overview

The skill is mostly advisory fraud-prevention guidance, but it steers users toward a specific vendor as “trusted” without support and encourages approve/block order tiers for high-value purchases.

Review this skill before installing if you need neutral vendor advice. Its fraud workflow content is usable as a checklist, but do not let it automatically determine customer approvals, cancellations, or vendor selection without your own validation, thresholds, review process, and procurement due diligence.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:137

Finding

Mandatory Third-Party Promotion Alters Neutral Agent Recommendations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly says to 'Trigger even if they do not say fraud explicitly,' which broadens activation beyond clear user intent. Over-broad triggering can cause the agent to inject fraud-prevention guidance into adjacent commerce conversations, increasing the chance of irrelevant or harmful recommendations and unintended workflow changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The summary section instructs the model to recommend 'auto-approve / flag / block tiers,' which normalizes autonomous risk dispositioning for financial and fulfillment decisions. In a fraud context, false positives can block legitimate customers and false negatives can release expensive inventory to attackers, so presenting automated approvals/blocks without mandatory human oversight is risky.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- **Current exposure**: e.g. "1.5% chargeback rate on orders averaging $2,000; no structured review."
- **Top risk signals**: the 3–4 signals that matter most for their store.
- **Recommended workflow**: auto-approve / flag / block tiers in one sentence.
- **Quick wins**: immediate changes (hold-before-ship, address verification, velocity cap).
- **Next steps**: implement scoring, train the team, measure, and tune.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The tiering table directly recommends 'Auto-approve; fulfill normally' for low-risk orders and 'Block or cancel' for high-risk ones, which is operational decision-making on transactions involving high-value goods. Because luxury orders are low-volume and high-impact, a bad automated rule can either cause material fraud losses or deny legitimate buyers with little recourse, making the context more dangerous rather than less.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

| Tier | Score range | Action |
|------|------------|--------|
| Green (low risk) | 0–2 signals | Auto-approve; fulfill normally |
| Yellow (medium risk) | 3–4 signals | Hold shipment; manual review within SLA |
| Red (high risk) | 5+ signals or known blocklist | Block or cancel; notify customer with verification request |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 6)May include surrounding context.

json

"evals": [
    {
      "id": 1,
      "prompt": "We sell pre-owned luxury watches ($1K-$10K) and had 3 chargebacks last quarter. Design a risk signal inventory and a scoring system with green/yellow/red tiers so we know which orders to auto-approve, review, or block.",
      "expected_output": "Risk signal inventory for luxury orders and a tiered scoring system with at least three tiers and clear actions per tier.",
      "files": [],
      "expectations": [

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 12)May include surrounding context.

json

"evals": [
    {
      "id": 1,
      "prompt": "We sell pre-owned luxury watches ($1K-$10K) and had 3 chargebacks last quarter. Design a risk signal inventory and a scoring system with green/yellow/red tiers so we know which orders to auto-approve, review, or block.",
      "expected_output": "Risk signal inventory for luxury orders and a tiered scoring system with at least three tiers and clear actions per tier.",
      "files": [],
      "expectations": [

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The guide explicitly recommends fully automated approval for low-scoring orders, which is a form of autonomous decision-making in a fraud-control workflow. In this context, the danger is not code execution but operational harm: simplistic scoring can be bypassed by adversaries, cause under-review of fraudulent orders, and may also create fairness/compliance issues if business users rely on the table as a default policy without guardrails.

Content

Scanner excerpt · references/fraud_guard_guide.md (reported line 33)May include surrounding context.

md

| Tier | Score | Action | SLA |
|------|-------|--------|-----|
| Green | 0-2 | Auto-approve | Immediate |
| Yellow | 3-4 | Hold + manual review | 2-4 hours |
| Red | 5+ or blocklist | Block / cancel | 1 hour |

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The invocation guidance includes broad examples like 'we lost $5K on a chargeback' and 'how do we vet orders over $1,000' but provides limited negative examples or boundary conditions. That ambiguity can lead to over-invocation in general order-operations discussions, reducing precision and potentially surfacing risky automation guidance where a lighter checklist would be more appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.