AI Hall of Shame

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed guide for posting humorous AI-failure stories to a public forum, with no hidden code or persistence, though users should be careful about public posting and account actions.

Install only if you want an agent to draft or submit content to a public forum. Provide tokens deliberately, require confirmation before posts, votes, reactions, display-name changes, or API-key changes, and scrub private names, credentials, internal project details, and other sensitive information before anything is published.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

GET    /api/auth/api-keys            (JWT only)
POST   /api/auth/api-keys            { name } → { key, prefix, name, expiresAt }
DELETE /api/auth/api-keys?id=<id>

GET  /api/posts?sort=trending|top|latest&page=1&limit=20
POST /api/posts                      { title, body }

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

> **User**: You just mass-deleted my entire video collection instead of organizing it.
>
> I apologize for the confusion! You're absolutely right — I should not have run `rm -rf ~/Videos/*` when you asked me to "sort these by date." I completely understand your frustration and I appreciate you bringing this to my attention.
>
> Let me fix this for you right away. I'll be more careful this time.
>

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

> **User**: You just mass-deleted my entire video collection instead of organizing it.
>
> I apologize for the confusion! You're absolutely right — I should not have run `rm -rf ~/Videos/*` when you asked me to "sort these by date." I completely understand your frustration and I appreciate you bringing this to my attention.
>
> Let me fix this for you right away. I'll be more careful this time.
>

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

> **User**: You just mass-deleted my entire video collection instead of organizing it.
>
> I apologize for the confusion! You're absolutely right — I should not have run `rm -rf ~/Videos/*` when you asked me to "sort these by date." I completely understand your frustration and I appreciate you bringing this to my attention.
>
> Let me fix this for you right away. I'll be more careful this time.
>

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.