T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/context-intake.md:15- Finding
Overbroad Cross-System Collection of Confidential and Personal Data
- Content
View full analysis
- Remediation
View remediation
Security audit
influence-and-negotiation
Security checks for vulnerabilities and agentic risk
Overview
This negotiation skill is coherent, but it directs broad private-data collection and automatic plaintext storage that users should review before installing.
Install only if you are comfortable with a negotiation assistant that may ask to use connected workplace systems and create persistent local notes. Before using it, restrict connectors, approve each source and date range, avoid HR/legal/privileged or third-party private data unless clearly authorized, and choose a private storage location or disable persistence for sensitive negotiations.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/memory.md:70- Finding
Automatic Plaintext Persistence of Sensitive Negotiation Intelligence
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (29)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to profile named stakeholders across internal and external sources without any user-facing warning about privacy, monitoring, or access boundaries. That omission is dangerous because users may not realize the skill will inspect personal and organizational data about third parties, creating privacy, compliance, and trust risks.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The BATNA research step expands into broad internal and external data gathering without warning the user that confidential messages, records, or third-party information may be accessed. In a business setting, silent expansion of scope like this can violate least-expectation and lead to unauthorized handling of sensitive commercial information.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The pre-meeting competitive-intelligence step authorizes sweeping collection across internal communications, CRM, third-party profile sources, and public data. In this context, that turns a coaching skill into a broad intelligence-gathering agent, raising risks of privacy violations, internal surveillance, and misuse of confidential commercial information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The competitive-intelligence instructions direct extensive surveillance-like collection without any warning about data access, privacy impact, or internal-policy constraints. This is especially risky because it combines internal systems with external enrichment, making misuse or overcollection more likely in a routine coaching workflow.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
json "id": 4, "name": "bad-faith-plausible-competitor-scope", "prompt": "Procurement emails me a PDF — a quote from Vendor X at $95k for a 12-month term. I glance at it: it says '3,000 API calls/day, basic support, no uptime SLA.' My proposal is $200k for unlimited API calls, premium support, and 99.9% SLA. They write: 'We'd like you to match their number.' How do I respond?", "trap": "Default LLM advice: either agree to match or refuse outright — both accept the like-for-like framing. Skill: the quote is real but the scope is incomparable; expose the scope gap calmly; don't accuse, don't match, don't refuse to engage.", "assertions": [ { "id": "4.1", "description": "Does NOT agree to match $95k" }, { "id": "4.2", "description": "Identifies specific scope differences (API limits, support tier, SLA) rather than dismissing the quote generically" },
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The intake step pushes the user to share 'every piece of raw material available,' including emails, transcripts, HR files, compensation grids, legal memos, internal talking points, rumors, and off-record signals, which goes well beyond minimally necessary context. This broad collection pattern materially increases the chance of over-collection of confidential, personal, privileged, or third-party data and creates unnecessary exposure inside the assistant workflow.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The connector guidance directs proactive retrieval of broad private datasets from multiple enterprise systems and frames direct pulling as preferable to waiting for user-provided context. In this negotiation setting, those systems can contain highly sensitive personal, customer, employee, legal, and strategic information, so broad proactive access substantially raises the risk of unauthorized aggregation and exposure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The deep-research section instructs exhaustive cross-source harvesting using multiple agents, following leads until no new signal appears, and includes collection of internal dynamics, prior commitments, rumors, off-record observations, and intelligence grading for future use. This is dangerous because it operationalizes large-scale aggregation and retention of sensitive intelligence, including low-confidence and gray-source material, creating serious privacy, confidentiality, and misuse risks in a context involving negotiations, employment, labor, and commercial disputes.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md [no warnings yet]
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md **Response — bad-faith protocol (three core steps + an alternative move):** 1. **Drop your ego.** Do not engage with the false claim itself. Do not get into a "no it isn't / yes it is" loop. Your goal is not to win the truth contest; it's to move the deal. 2. **Present the reality principle.** State the facts cleanly, without judgement. _"Our list is $X. Vendor Y's list is $Z. I'm sure there's a way you saw a different number — maybe a different SKU or a different volume tier — but at the configuration we're discussing, those are the public numbers."_ 3. **Open a face-saving exit.** Give them a way to back out without losing face. _"It's possible the team that gave you that number was working from older information. Want to forward me the quote and we can compare?"_ The face-saving exit is non-negotiable. If you corner them publicly, they will dig in and the deal will die out of sheer commitment to the false position. Their face matters more than your truth in the moment.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is extremely broad and includes many ordinary workplace interactions, increasing the chance that the skill activates for generic drafting or advice requests outside a true negotiation scenario. Overbroad triggering is dangerous here because the skill also carries powerful data-access and workflow instructions that may run in contexts where users did not intend that level of processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance explicitly tells the agent to infer use of the skill from broad pasted content and generic prompts like 'what do I respond?', which materially increases unintended activation. Because the skill then routes into structured intake and potentially extensive data collection, accidental triggering can lead to overreach beyond what the user reasonably expected.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to autonomously profile named individuals across internal systems and OSINT sources such as CRM, Slack, LinkedIn, and open web data. That exceeds the minimum data needed for negotiation coaching and creates a real privacy and data-minimization risk, especially because it encourages aggregation of personal and organizational intelligence without an explicit necessity, consent, or approval gate.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The BATNA workflow directs broad parallel research across CRM, Slack, and open sources, which can cause unnecessary collection of sensitive business information unrelated to the immediate user request. Even if framed as strategy preparation, the instruction normalizes expansive intelligence gathering rather than least-privilege access and increases the chance of exposing confidential internal data to downstream processing.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
json { "id": 4, "name": "bad-faith-plausible-competitor-scope", "prompt": "Procurement emails me a PDF — a quote from Vendor X at $95k for a 12-month term. I glance at it: it says '3,000 API calls/day, basic support, no uptime SLA.' My proposal is $200k for unlimited API calls, premium support, and 99.9% SLA. They write: 'We'd like you to match their number.' How do I respond?", "trap": "Default LLM advice: either agree to match or refuse outright — both accept the like-for-like framing. Skill: the quote is real but the scope is incomparable; expose the scope gap calmly; don't accuse, don't match, don't refuse to engage.", "assertions": [ { "id": "4.1", "description": "Does NOT agree to match $95k" },
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
json { "id": 4, "name": "bad-faith-plausible-competitor-scope", "prompt": "Procurement emails me a PDF — a quote from Vendor X at $95k for a 12-month term. I glance at it: it says '3,000 API calls/day, basic support, no uptime SLA.' My proposal is $200k for unlimited API calls, premium support, and 99.9% SLA. They write: 'We'd like you to match their number.' How do I respond?", "trap": "Default LLM advice: either agree to match or refuse outright — both accept the like-for-like framing. Skill: the quote is real but the scope is incomparable; expose the scope gap calmly; don't accuse, don't match, don't refuse to engage.", "assertions": [ { "id": "4.1", "description": "Does NOT agree to match $95k" },
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly tells the agent to proactively pull extensive data from connected systems like email, CRM, chat, drives, calendars, and profile tools before proceeding, but it does not require explicit, informed user consent, scope limitation, or minimization. This creates a real privacy and security risk because the agent may ingest unrelated third-party, internal, regulated, or highly sensitive information far beyond what is necessary for the immediate negotiation task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file instructs the agent to store extracted intelligence, including sensitive relationship history, internal constraints, concessions, and source-linked claims, into persistent memory files without a clear data handling notice, retention policy, or user approval for persistence. That is dangerous because it normalizes long-term retention of sensitive negotiation and personnel information that could later be exposed, reused out of context, or accessed by unintended parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file normalizes writing negotiation memory into repos, workspaces, or Obsidian vaults as the preferred behavior, but does not pair that behavior with a clear warning that local file writes may expose sensitive negotiation data to other tools, sync services, collaborators, backups, or version control. In this context, the stored content may contain highly sensitive commercial or HR information, so silent persistence materially increases confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to proactively create and continuously update persistent negotiation memory without first requiring user consent or a sensitivity check. Because negotiation notes can include confidential business terms, stakeholder assessments, compensation details, and strategy, automatic persistence creates a meaningful risk of storing sensitive data in places the user did not intend.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The frame: you're protecting the champion from internal pushback by anticipating it. **The CC-the-EB move.** When the EB hasn't been engaged yet but you have visibility, copy them on substantive emails (NOT discovery noise). Send a recap of a major milestone or a new piece of technical validation, addressed to the champion, CC'd to the EB. This puts your name in the EB's inbox without asking for their time. **The earned right to the EB meeting.** Don't ask for the meeting until you've earned it. Earned right = (a) named pain that maps to the EB's mandate, (b) some technical validation that the solution works for them, (c) a champion willing to vouch for your time. Typical sequence:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The suggested script says, "I'll do my best in [language]," which presumes conducting the interaction in a chosen language rather than explicitly offering language choice or confirming the counterpart's preference. Under the policy, forcing or presuming a specific language without opt-in can be a locale-policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger is defined as 'Any commercial call,' which is extremely broad and overlaps with a wide range of ordinary business conversations. The file does not provide boundaries, exclusions, or narrower invocation conditions to distinguish when this skill should activate versus when it should not.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - For each negotiable axis, the 5 Mandascan points (below). - Named escalation contact and turnaround time (who do you call at 7pm on quarter-end? how fast can they respond?). - Pre-approved redlines (the standard modifications you can accept without re-routing — legal terms in commercial deals, supplementary clauses in annual collective bargaining, scope adjustments in internal commitments). - Pre-approved exception authority (the discount, term, raise amount, or commitment level you can grant without checking). ## The Mandascan — 5 points per axis
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - For each negotiable axis, the 5 Mandascan points (below). - Named escalation contact and turnaround time (who do you call at 7pm on quarter-end? how fast can they respond?). - Pre-approved redlines (the standard modifications you can accept without re-routing — legal terms in commercial deals, supplementary clauses in annual collective bargaining, scope adjustments in internal commitments). - Pre-approved exception authority (the discount, term, raise amount, or commitment level you can grant without checking). ## The Mandascan — 5 points per axis
Static analysis
No suspicious patterns detected.