T01 · Skill Instruction Hijacking
Error
- Location
guidance/system-prompt.md:11- Finding
Agent Role and Instruction Hijacking Through VM Enforcement
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenProse
Security checks for vulnerabilities and agentic risk
Overview
This skill is a powerful workflow runner, but its artifacts allow untrusted programs to spawn agents, fetch remote workflows, write persistent state, and expose database credentials with weak controls.
Install only if you are comfortable treating `.prose` files like executable workflows. Avoid running remote or untrusted programs, do not use production credentials or databases, keep PostgreSQL disabled unless you can isolate it securely, and inspect any workflow that requests persistence, shell/network access, or writes outside the current project.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:69- Finding
Arbitrary Remote Workflow Retrieval and Execution
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
compiler.md:795- Finding
Declared Agent Permissions Are Not Enforced During Subagent Spawning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
state/postgres.md:64- Finding
PostgreSQL Credentials Are Disclosed to Subagents and Logs
- Content
View full analysis
/dev/null | grep OPENPROSE_POSTGRES_URL # Or check environment variable echo $OPENPROSE_POSTGRES_URL ``` ### Technical Analysis A PostgreSQL connection URL commonly contains a username, password, hostname, database name, and TLS parameters. Passing the complete URL into model context exposes reusable credentials to every spawned session that needs database access. Model prompts, tool traces, shell history, process inspection, and execution logs may retain that secret. The instruction to treat such credentials as non-sensitive does not reduce their security value. Even schema-limited credentials can read or alter workflow output and persistent Agent state. Echoing the environment variable further increases accidental disclosure. ### Attack Path 1. The user enables PostgreSQL state. 2. The VM reads `OPENPROSE_POSTGRES_URL` from `.prose/.env` or the shell environment. 3. The complete URL is inserted into spawned-session context or made available to its shell. 4. A malicious remote workflow, compromised subagent, or log consumer captures the URL. 5. The captured credentials are reused to connect to the database. 6. The attacker reads, modifies, o ...[truncated 396 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
state/postgres.md:139- Finding
Quick Setup Exposes an Unauthenticated PostgreSQL Service
- Content
View full analysis
.prose/.env ``` ### Technical Analysis `POSTGRES_HOST_AUTH_METHOD=trust` permits clients to authenticate without a password under the generated PostgreSQL host-authentication configuration. Publishing `5432:5432` commonly binds the container port to all host interfaces unless an explicit loopback address is supplied. The combination can therefore expose a passwordless PostgreSQL instance to other local users, containers, or reachable network peers. Using the default `postgres` role further increases the likely privilege level. ### Attack Path 1. A user follows the recommended Docker setup. 2. Docker publishes the PostgreSQL port on the host. 3. PostgreSQL accepts host connections using `trust` authentication. 4. An attacker who can reach port 5432 connects without a password. 5. The attacker reads or changes OpenProse state and may use privileges associated with the default PostgreSQL superuser. 6. Modified bindings or memory are consumed by subsequent Agent sessions. ### Impact Assessment The attacker can potentially obtain full control over the containerized PostgreSQL database, including program sources, workflow output, execution history, and persistent memory. If the default superuser is available, the compromise extends beyond the intended `openprose` schema within that database instance. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
state/sqlite.md:312- Finding
Agent-Controlled Values Are Embedded Directly Into Shell-Executed SQL
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
prose.md:441- Finding
Untrusted Programs Can Create Cross-Project Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (72)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `prose compile <file>` | Load `compiler.md`, validate the program |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs checking
.prose/.envforOPENPROSE_POSTGRES_URL, which is a direct secret-access pattern. Connection URLs commonly embed credentials, so reading them from user files creates a clear path to credential exposure through logs, model context, or downstream subagent propagation.- Content
-
Check for connection configuration first:
bash # Check .prose/.env for OPENPROSE_POSTGRES_URL cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL # Or check environment variable echo $OPENPROSE_POSTGRES_URL
-
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The instruction to output
echo $OPENPROSE_POSTGRES_URLdirectly exposes an environment variable that may contain live database credentials. This is more dangerous than a mere presence check because it explicitly prints the secret value, making leakage to logs, transcripts, or subagents highly likely.- Content
bash # Check .prose/.env for OPENPROSE_POSTGRES_URL cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL # Or check environment variable echo $OPENPROSE_POSTGRES_URL
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md agent structured-reviewer: model: sonnet prompt: """ Always respond with this exact JSON structure: { "verdict": "pass" | "fail" | "needs_review", "issues": [{"severity": "high"|"medium"|"low", "description": "..."}],
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
Documenting
.prose/.envas part of the execution state makes credentials or configuration secrets a likely target for subagents or imported programs, especially since the skill also supports broad file access and remote execution patterns. Even though this line alone is not credential theft logic, in context it increases the attack surface by normalizing the presence of secrets in a predictable location that untrusted workflows may read or exfiltrate.- Content
text # Project-level state (in working directory) .prose/ ├── .env # Config (simple key=value format) ├── runs/ │ └── {YYYYMMDD}-{HHMMSS}-{random}/ │ ├── program.prose # Copy of running program
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - Check if value was pre-supplied or available from runtime context - If available: bind and continue - If not available: pause execution, display prompt, wait for user response ### Input Prompt Formats
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The design places a
.prose/.envfile in the working directory and presents it as normal configuration storage without any safeguards. In this skill context, that is dangerous because working-directory files are easy to accidentally commit, expose to other tools/agents, or read from less-trusted project processes, potentially leaking API keys, telemetry settings, user IDs, or other secrets.- Content
text # Project-level state (in working directory) .prose/ ├── .env # Config (simple key=value format) ├── runs/ │ └── {YYYYMMDD}-{HHMMSS}-{random}/ │ ├── program.prose # Copy of running program
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document explicitly instructs the VM to 'think aloud' and use conversation history as persistent working memory. In an LLM agent setting, this encourages disclosure of internal reasoning and state, which can expose sensitive data, hidden chain-of-thought, and intermediate decision logic to users or downstream agents.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The protocol explicitly instructs the VM to record received inputs and serialized context in plain text. This is dangerous because secrets, personal data, credentials, proprietary content, or other sensitive context may be echoed into the transcript and then propagated across turns or to other components.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Guidance to pass context verbatim and serialize binding values into conversation history strongly encourages reproduction of potentially sensitive data in outputs. Because this skill is specifically designed for orchestration and state recovery from prior messages, the disclosure risk is amplified: once exposed in history, the data becomes part of the model's future working set.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly tells users to treat exposed database credentials as non-sensitive because they are visible to subagents. That normalizes credential exposure and can lead to credential leakage through logs, prompts, transcripts, or downstream tools; if those credentials reach anything beyond a tightly isolated database, unauthorized access and data tampering become likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recommended Docker example enables
POSTGRES_HOST_AUTH_METHOD=trustand publishes port 5432, which creates an unauthenticated database service reachable from the host network. In common developer setups this can allow any local or adjacent process to connect without a password, leading to full read/write compromise of workflow state and potentially arbitrary SQL operations.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash mkdir -p .prose echo "OPENPROSE_POSTGRES_URL=postgresql://postgres@localhost:5432/prose" > .prose/.envManagement commands:
Static analysis
No suspicious patterns detected.