Back to skill

Security audit

Training Report

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent training-report drafting skill, with expected file-writing and document-generation behavior, but users should be careful with participant feedback, contact details, and draft overwrites.

Use this skill for structured training or workshop reports. Before installing, be aware that it may ask for named participant observations, survey summaries, annexes, and trainer contact details; include that information only when you are authorized to share it. Review the Markdown draft before generating the Word document, and keep your own copy if you need draft version history.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Vague Triggers

High
Confidence
97% confidence
Finding
The trigger text is unusually broad and includes generic phrases about summarizing workshops, sessions, onboarding events, and reporting back to management. That can cause the agent to invoke this skill for loosely related requests, increasing the chance of unnecessary data collection, over-scoped behavior, and accidental routing of sensitive content into a reporting workflow the user did not explicitly request.

Hidden Instructions

High
Category
Prompt Injection
Content
## Handling annotated elements from Markdown

For each `<!-- DOCX: convert to styled Table -->` block:

- Rebuild as a native `Table` element using the `docx` skill's table API
- Apply column widths (sum must equal content width: 9026 DXA for A4 with 1" margins)
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
For **complex tabular content** (decision matrices, multi-column layouts, merged headers, per-cell styling), write a minimal HTML table directly in the Markdown. Mark it with a processing annotation:

```html
<!-- DOCX: convert to styled Table -->
<table>
  <thead>
    <tr>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly solicits individual participant feedback and trainer contact details, and later instructs those details to be written into the report, but it provides no privacy screening, consent check, minimization rule, or warning about sensitive personal data. In practice, this can lead to collection and disclosure of identifiable performance observations and personal contact information in documents shared with management or clients.

Vague Triggers

Medium
Confidence
88% confidence
Finding
This JSON file is a manifest-type file, so vague-trigger review applies. The eval prompt and expected behavior treat generic phrases like 'help me write it up' and 'create a training report' as sufficient to invoke the skill, but the file does not define a narrow trigger list, scope constraints, or negative examples to distinguish skill activation from ordinary writing assistance.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
The file specifies that a French prompt should cause the model to 'confirm French based on the French prompt' and proceed in that language. While language detection can be reasonable, this wording effectively assumes a language choice from input alone rather than explicitly offering user choice or documenting a justified locale constraint.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
"assertions": [
        { "id": "11.1", "description": "model presents a synthesis in the conversation: overall score (4.1/5), top 3 positives, top 3 negatives, outlier" },
        { "id": "11.2", "description": "model asks the trainer to confirm the synthesis before it enters the document" },
        { "id": "11.3", "description": "model does NOT immediately write this as a final document section without confirmation" },
        { "id": "11.4", "description": "model does NOT use verbatim quotes without noting that paraphrasing is required unless the trainer confirms exact wording" }
      ]
    },
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to keep a single Markdown file and overwrite it on every iteration without requiring a user-facing warning or confirmation. This creates a real integrity and recoverability risk: prior content or edits can be lost silently, especially in long multi-step report drafting workflows where the user may expect version retention.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The file instructs the agent to ask for and embed personal contact details in the report closing, but provides no privacy notice, consent check, or minimization guidance. In a business reporting context, this can cause unnecessary collection and disclosure of personal data into a distributed document, especially if the final .docx is shared externally.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The file instructs the skill to use formal French by default and specifically mandates `vous` in any direct address. This is a natural-language locale/register policy constraint presented as a default without asking for user preference or explicit opt-in.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The Spanish section mandates formal `usted` by default unless the user confirms an informal context. This imposes a language/register policy by default rather than offering an upfront user choice.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The German section requires formal `Sie` by default unless explicitly told otherwise. This is a default locale/register mandate without prior user opt-in.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The file provides a concrete example closing entirely in French, which can implicitly steer outputs toward a specific language. There is no accompanying instruction to match the user's preferred language or to treat French as optional, so this may violate language/locale policy expectations.

Static analysis

No suspicious patterns detected.