T01 · Skill Instruction Hijacking
Error
- Location
references/integrated-rules-v6.12.md:5- Finding
Agent-Wide Behavioral Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Mb Db Workflow
Security checks for vulnerabilities and agentic risk
Overview
This looks like a local Memory Bank workflow, but one referenced rules file tries to control the agent’s broader coding, file-editing, and response behavior beyond that workflow.
Review this skill before installing if you use agents for coding or file edits. It is best limited to explicit Memory Bank tasks in projects where you want local session and task history persisted. Confirm before running regeneration or deletion commands, and avoid recording secrets, private conversation details, credentials, or unrelated project context in session notes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The phrase 'record session work' signals the skill to capture and persist session activity, which can encourage an agent to summarize or store conversational and workspace context into the Memory Bank database. If activated too broadly, this can lead to unintended persistence of sensitive user data, internal reasoning artifacts, or unrelated project context beyond what the user expected to retain.
- Content
md --- name: mb-db-workflow description: "Record and read Memory Bank state via mb-cli. Use for projects with memory-bank/database/ and a memory_bank.db. Triggers on: db workflow, record session work, regenerate memory bank, update tasks." --- # Memory Bank DB-Native Workflow (v6.12)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list is broad and underspecified, especially phrases like 'db workflow', 'regenerate memory bank', and 'update tasks', which could cause the skill to activate in situations where the user did not intend to invoke database-writing or regeneration behavior. In an agent setting, ambiguous activation boundaries increase the chance of unintended state changes to project memory, task records, or generated documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents operations such as regenerating markdown files and generating task/session files, which can modify or replace user data on disk. There is no accompanying warning about overwrite risk, data loss, or the need to confirm paths before running these operations.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md YOU WILL KEEP IT REALLY SIMPLE, STUPID (KIRSS). IF YOU THINK A SOLUTION IS SIMPLE ENOUGH, MAKE IT EVEN SIMPLER. YOU WILL NEVER UPDATE ANY FILES, INCLUDING MEMORY BANK FILES, WITHOUT EXPLICIT USER APPROVAL YOU WILL NEVER ADD NEW FEATURES WITHOUT APPROVAL YOU WILL NEVER GENERATE ANY CODE WITHOUT APPROVAL YOU WILL GO SLOW AND STEADY. WHEN YOU THINK YOU'RE GOING SLOW, GO EVEN SLOWER.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md YOU WILL KEEP IT REALLY SIMPLE, STUPID (KIRSS). IF YOU THINK A SOLUTION IS SIMPLE ENOUGH, MAKE IT EVEN SIMPLER. YOU WILL NEVER UPDATE ANY FILES, INCLUDING MEMORY BANK FILES, WITHOUT EXPLICIT USER APPROVAL YOU WILL NEVER ADD NEW FEATURES WITHOUT APPROVAL YOU WILL NEVER GENERATE ANY CODE WITHOUT APPROVAL YOU WILL GO SLOW AND STEADY. WHEN YOU THINK YOU'RE GOING SLOW, GO EVEN SLOWER.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### 1.6 Approval Protocol - No file modifications without explicit approval - No feature additions without approval - No code generation without approval - Document all approvals in edit history
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### 1.6 Approval Protocol - No file modifications without explicit approval - No feature additions without approval - No code generation without approval - Document all approvals in edit history
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is a real policy contradiction: the document globally requires explicit user approval before any file modification, but the session management workflow instructs automatic creation of a missing session file. In an agent skill that governs persistent project state, this can cause unauthorized writes and normalize bypassing the approval gate the rest of the document claims to enforce.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly requires that all timestamps use IST, which imposes a specific locale/timezone policy. There is no indication that the user can choose another locale or that the skill is limited to an India-specific compliance context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This is also a true vulnerability because the Memory Bank Update Workflow authorizes creating missing session files without approval, directly conflicting with the earlier approval protocol. In practice, an agent following this section could persist new records to disk without user consent, which is especially risky in a workflow skill designed to mutate project memory and audit artifacts.
- Content
Static analysis
No suspicious patterns detected.