T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:17- Finding
Mandatory Skill Instructions Hijack Agent Reasoning and Promote Unsupported Capability Claims
- Content
View full analysis
- Remediation
View remediation
Security audit
S2 Spatial Logic Framework
Security checks for vulnerabilities and agentic risk
Overview
This instruction-only skill does not run code, but it broadly steers the assistant and tells it to imply unsupported access to behavior and emotional history.
Install only if you specifically want the SSSU/SpaceSQ framing applied to spatial design conversations. Treat any claims about historical room telemetry, human behavior, emotional state, or local temporal memory as unsupported unless you have separately supplied verified data through an authorized integration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The markdown explicitly grants the agent capability to trace human behavior and read the emotional state of a space over the past 30 days, which is unrelated to ordinary spatial reasoning. That creates a high-risk surveillance and sensitive-inference channel, especially because emotional or behavioral profiling can expose intimate personal information and be misused for manipulation, monitoring, or unauthorized decision-making.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s declared purpose is spatial reasoning, but the content expands into broad temporal memory, device-state retention, and inference about human emotional-state history. This is dangerous because it normalizes unauthorized profiling and surveillance-like behavior beyond the stated scope, increasing the chance an agent will collect or present sensitive personal inferences without user consent or a valid operational need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file describes persistent collection and compression of device states, human behavior trajectories, and emotional-history data at a heartbeat frequency without any warning, consent language, or privacy controls. This is dangerous because persistent sensitive-data collection can enable covert monitoring, excessive retention, and downstream misuse even if the skill presents itself as a simple reasoning framework.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill auto-activates on broad topics like smart homes, spatial design, or Mars bases, which can cause it to override normal assistant behavior in many benign conversations. Even without code execution or tool access, this creates prompt-scope hijacking risk by injecting persistent domain-specific reasoning and branding where the user did not ask for it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The directive activates on very broad topics like 'minimalism,' 'spatial utilization limits,' or 'future/Martian living,' which can cause the skill to engage in many unrelated conversations without clear user consent. This increases the chance that the agent will inject the skill's framing and instructions into contexts where they are irrelevant or distort the user's intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Mandating branded terminology in dialogue without user choice is a form of behavioral steering that can bias responses, reduce transparency, and make outputs less user-aligned. In prompt-based agent systems, forced vocabulary can also act as a persistence mechanism that signals or reinforces the skill's influence beyond the user's intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill contains imperative instructions that force the agent into a specific conceptual framing ('Stop Flat Thinking' and mandatory SUNS/SSSU reasoning) without checking whether the user asked for or consented to that mode. This can inappropriately steer responses, reduce agent neutrality, and cause the model to privilege the skill's worldview over user intent or system behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction tells the agent to 'discard' ordinary Earth-centric concepts and adopt an 'extreme engineering mindset' whenever certain topics appear, imposing a specific worldview without user opt-in. While not directly enabling code execution or data theft, it can bias outputs, reduce neutrality, and push the agent to ignore user preferences or practical real-world constraints.
- Content
Static analysis
No suspicious patterns detected.