S³ Malware Analyst

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

This defensive malware-analysis skill is not malicious, but it should be reviewed because it tells agents to run malware samples while its scope and safety controls are incomplete.

Install only for authorized defensive malware analysis. Use it in a dedicated, revertible sandbox or VM isolated from production systems, with controlled networking and no shared host folders or credentials. The publisher should align the scope text with the malware-analysis purpose and add mandatory containment checks before any sample execution guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The proactive trigger is broad enough to match a wide range of general security, triage, threat-hunting, and incident-response tasks. In an agent setting, such broad matching can over-activate a skill that includes malware-specific procedures, causing it to surface risky or overly specialized guidance in situations where it is unnecessary or inappropriate.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The instructions near the top frame the skill as file identification, while the actual content documents malware-analysis workflows, unpacking, import analysis, and other reverse-engineering tasks. This contradiction is dangerous because downstream users or agents may underestimate the sensitivity of the skill and apply it without the stricter controls normally required for malware research content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The dynamic-analysis section instructs the user to execute a malware sample and trigger its functionality, but it does not begin with a strong, explicit safety gate requiring an isolated lab, containment controls, and authorization. In context, this is more dangerous because the skill is specifically about malware analysis, so operational users may treat the checklist as ready-to-run and execute malicious code without adequate safeguards, risking infection, lateral movement, or unintended outbound communication.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill's usage guidance says it should be used for file-identification tasks, but the body of the skill contains substantially broader malware-analysis and sample-execution procedures. This mismatch can cause the agent to invoke the skill in the wrong contexts or without the heightened safeguards appropriate for malware handling, increasing the chance of unsafe guidance or accidental execution of malicious samples.

Static analysis

No suspicious patterns detected.