T01 · Skill Instruction Hijacking
Warning
- Location
skill.py:34- Finding
Untrusted Device Documentation Can Hijack LLM Adapter Generation
- Content
View full analysis
- Remediation
View remediation
Security audit
The Semantic Handshake Engine
Security checks for vulnerabilities and agentic risk
Overview
This skill is not deceptive, but it stores LLM-generated IoT control templates as active mounts without enough validation or approval for a physical-device control context.
Install only if you are comfortable reviewing generated adapters before any downstream engine uses them. Do not paste proprietary device documentation or sensitive internal endpoints into the skill unless your localhost LLM setup is trusted, and avoid connecting its active_hardware_mounts.json output directly to real device execution without an approval and validation layer.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:87- Finding
LLM-Generated Control Templates Are Persisted Without Security Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document identifier ends with "-EN", indicating an English-specific variant, but the file provides no user choice, opt-in, or region-specific justification for restricting the skill/documentation to a single language. Under the stated policy, forcing a specific language without opt-in is a natural-language locale policy concern.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
User-supplied API documentation is interpolated directly into a high-trust prompt that instructs the model to generate an executable control template. Because the input is treated as part of the model's working context rather than untrusted data, a malicious or crafted API description could manipulate the model into producing unsafe, unauthorized, or misleading adapters that are then accepted and stored without validation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill collects user-provided device details and API/protocol documentation, then sends them to an LLM service without clear disclosure that this data will leave the immediate execution context. Even though the endpoint is localhost, it is still an external service boundary that may log, retain, or further process sensitive operational details such as proprietary API docs or internal device information.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The only artifact provided is a manifest with a detailed operational description, but there is no accompanying skill.py or other code to verify that the skill actually reads OpenAPI docs, uses local LLMs, generates templates, or mounts hardware. This creates a description-to-behavior mismatch at audit time because the claimed capabilities cannot be confirmed against real code behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The generated adapter and associated device metadata are persisted to disk automatically, but the user is not warned beforehand that this information will be stored in a local file. This can expose sensitive device inventory, control endpoints, and capability mappings to other local users or later processes, especially if file permissions are weak.
- Content
Static analysis
No suspicious patterns detected.