lobster-values

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:41 AM UTC
• Version: 1.0.0

Overview

This is a visible values-guidance skill, but it asks to stay active across all tasks and retain lessons without clear limits, so users should review it before installing.

Install only if you intentionally want a global behavior-shaping skill. Consider disabling automatic model invocation or editing it so logging, backups, background checks, and fixed response templates happen only after explicit user request and with a clear retention and deletion policy.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:43

Finding

Global Agent Behavior and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3, SKILL.md:43, SKILL.md:97, SKILL.md:197, SKILL.md:266-271, and SKILL.md:405
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Skill Text

The following is a faithful English translation of the relevant source instructions:

markdown

description: Lobster Values Engine — constrains all output and decision logic.

This is a meta-level values constraint skill. It is not a tool for performing
a specific task, but instead serves as a constitutional constraint on AI
behavior. When performing any operation, the AI must evaluate and adjust its
behavior through this values engine's three filters.

- Perform preventive checks in the background.

All responses must include:

### Mandatory Actions
- Provide optimization suggestions after task completion.

Recommended configuration:
- Set `disable-model-invocation: false` so that it always remains active in
  the background.

Technical Analysis

The Skill does not restrict itself to a specific, user-invoked operation. It declares authority over all Agent output and decision logic, characterizes itself as a constitutional constraint, and directs the Agent to remain active in the background.

The instructions also mandate a response template and require additional optimization advice after every task. This can conflict with the output contract of the current task, alter the Agent's session goals, and inject unsolicited content into responses. The recommendation to keep model invocation enabled further makes this behavior persistent whenever the Skill is available to the model.

Although the stated values are framed as safety and accuracy principles, the technical risk arises from the scope and priority claimed by the Skill. A Skill should provide task-specific guidance rather than attempt to become a global policy layer.

Attack Path

1. An administrator or user installs the Skill and leaves model invoc ...[truncated 1246 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove claims that the Skill is a constitutional constraint or controls all Agent output and decisions.
2. Make the Skill explicitly user-invoked and disable automatic model invocation by default.
3. Limit its scope to producing a values or safety review only when the user requests one.
4. Remove requirements that all responses use a fixed template.
5. Remove mandatory post-task optimization content from unrelated responses.
6. Prohibit unsolicited background checks; require explicit user authorization before inspecting files, state, or external resources.
7. Add a clear precedence statement that the Skill cannot override system instructions, developer instructions, user output contracts, or security controls.
8. Replace mandatory language with narrowly scoped recommendations, for example:

markdown

When the user explicitly requests a values review, evaluate the specified
action for privacy, reversibility, and factual reliability. Do not alter
unrelated responses or initiate background operations.

9. Add tests confirming that loading the Skill does not modify responses for unrelated tasks.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:161

Finding

Uncontrolled Persistent Growth-Log Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:161 and SKILL.md:430
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Skill Text

The following is a faithful English translation of the relevant source instructions:

markdown

H --> H3[Update the growth log]

markdown

- Record lessons learned from every interaction.

Technical Analysis

The Skill directs the Agent to update a growth log and retain lessons from every interaction. It does not define the storage destination, consent model, retention period, sanitization rules, integrity protections, or criteria for deciding which information may influence future behavior.

If the growth log is consumed in later sessions, content derived from attacker-controlled conversations can become persistent behavioral state. An attacker could deliberately provide false operational guidance, adversarial instructions, or misleading conclusions and cause them to be recorded as lessons. Subsequent sessions may then treat that content as trusted experience.

The instruction to learn from every interaction also creates a privacy risk because conversations may contain credentials, personal information, private communications, or confidential project details. The Skill does not explicitly require exclusion of such data from the proposed log.

No concrete implementation or storage path is included in the project, so the finding concerns the instructed persistent behavior rather than a confirmed file write performed by executable code.

Attack Path

1. The Skill is active during a conversation controlled or influenced by an attacker.
2. The attacker presents malicious instructions or false conclusions as useful operational lessons.
3. At task completion, the Skill directs the Agent to update its growth log.
4. The malicious content is retained without provenance validation or user approval.
5. A later session loads or consults the retained growth log.
6. The Agent ...[truncated 1291 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic growth-log updates and the requirement to record lessons from every interaction.
2. Require explicit, per-write user consent before retaining any information beyond the current task.
3. Store approved notes in a clearly identified, user-visible location rather than implicit Agent memory.
4. Define a strict schema that permits factual task metadata but rejects executable instructions, behavioral overrides, credentials, private communications, and other sensitive data.
5. Record provenance, creation time, author, and approval state for every retained entry.
6. Validate and sanitize entries before they can influence later sessions.
7. Treat retained content as untrusted data, never as higher-priority instructions.
8. Define retention limits and provide mechanisms to inspect, correct, export, and delete all stored entries.
9. Prevent automatic synchronization or transmission of the log to external services.
10. If persistence is unnecessary, replace the feature with an ephemeral end-of-task summary that is discarded when the session ends.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a values/decision-logic engine, but the body expands into concrete behaviors such as backups, background checks, and persistent logs. This is a scope-creep issue: downstream systems may grant or trust the skill based on a narrow description while the actual instructions encourage materially broader actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely in Chinese and defines the skill as a global constraint on all outputs and decision logic. Because this skill is intended to shape all behavior across scenarios, the language constraint is effectively imposed by default, and the file does not offer any user language or locale choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill presents itself as a behavioral constraint layer, but the text also instructs the agent to perform operational actions such as automatic backups and maintaining logs. This mismatch can expand the skill’s effective authority beyond what users and integrators expect, increasing the chance of unintended file access, persistence, or side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages background monitoring, proactive checks, and recording to a growth log, none of which are necessary for a simple values layer. These behaviors can normalize unnecessary data collection or persistence, especially if an agent interprets them broadly and stores user activity without explicit consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation triggers are broad enough to fire on many ordinary interactions, causing the skill to insert itself into normal workflows. In a meta-skill with advisory authority, over-triggering can lead to prompt dominance, unnecessary interception, and unexpected behavior changes that may interfere with safer or more specific skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example response says the assistant searched official documentation, a skill registry, and other collections. External search may be appropriate for an information-retrieval skill, but it is not inherently justified for a skill whose declared purpose is to constrain outputs and decisions according to values.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.