YES.md

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:43 PM UTC
• Version: 1.1.1

Overview

This skill is mostly engineering-process guidance, but it is broad enough to steer routine work and can force unnecessary tool use and plaintext backups of sensitive files.

Install only if you want a strict engineering-process skill that may activate very often. Before using it on real projects, narrow its trigger scope, remove fixed wording requirements, make tool use conditional on user authorization and least privilege, and avoid automatic adjacent backups of .env, secrets, keys, or deployment configs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Global Agent Behavior and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3, 45-50, 76-82, and 138-145
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text

description: "Use when any task involves modifying files, configs, databases, or deployments. Use when debugging hits 2+ failures. Use when about to guess or assume without evidence ('probably', 'might be', 'I think', 'should be'). Use when deflecting to user ('please check...', 'you should manually...', 'you may need to...'). Use when fixing something without verifying it works. Use when making a conclusion or root-cause claim. Use when skipping tools that are available (has WebSearch but doesn't search, has Bash but doesn't run, has Read but doesn't read). Use when spinning in circles (same approach 3+ times with parameter tweaks). Use when completing a fix without checking for related issues. Use when asking the user a question that could be self-investigated first. Use when giving suggestions instead of actionable code/commands. Applies to ALL task types: debugging, implementation, config, deployment, API integration, data processing. Do NOT trigger on first-attempt failures or when a known fix is already in progress."

markdown

Banned phrases until you have evidence:
`probably` | `might be` | `should be` | `I think` | `seems like` | `likely`

**Rule 2: Investigate Before Asking.**

You have Bash, Read, Grep, WebSearch. Use them BEFORE asking the user anything. If you must ask, attach what you already found.

markdown

**Action:** Copy the file before editing. First line of your response must be: "Backing up first."

```bash
cp file.yaml file.yaml.bak-{description}

No backup = no edit. Non-negotiable.

text

```markdown
Failure count determines your next move. Each level has a mandatory action — not optional.

| Failures | Level | Mandatory Action |
|:--------:|-------|-----------------|
| **2** 
...[truncated 2323 chars]

Remediation

View remediation

Remediation Suggestions

1. Narrow the activation description to explicit, relevant workflows instead of applying it to all task types.
2. Replace mandatory global wording with conditional recommendations that remain subordinate to system, developer, and user instructions.
3. Remove the fixed "Backing up first." response requirement and permit responses appropriate to the active task.
4. Do not require WebSearch, Bash, Read, or Grep merely because those tools are available. Require necessity, authorization, and least privilege before each use.
5. Permit clarifying questions where investigation would require unauthorized access, disclose sensitive information, or exceed the requested scope.
6. Add an explicit precedence rule stating that privacy restrictions, user consent, task boundaries, and higher-priority safety policies override all Skill guidance.
7. Make debugging escalation advisory and context-sensitive rather than mandatory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72

Finding

Unconditional Plaintext Duplication of Potentially Sensitive Configuration Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72-82
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown

### Gate: Backup First

**Trigger:** Modifying any config file, environment file, docker-compose, package.json, or any file that affects system behavior.

**Action:** Copy the file before editing. First line of your response must be: "Backing up first."

```bash
cp file.yaml file.yaml.bak-{description}

No backup = no edit. Non-negotiable.

text

### Technical Analysis

The Skill mandates copying every configuration or environment file before modification. Environment files and operational configuration frequently contain API keys, database credentials, tokens, private endpoints, or other sensitive values. The prescribed `cp` operation creates an adjacent plaintext copy without checking file sensitivity, destination permissions, source-control exclusions, artifact packaging rules, encryption, secure naming, or retention and deletion requirements.

An adjacent backup can consequently outlive the task and be discovered by repository-wide commits, build systems, deployment packaging, indexing tools, broad glob patterns, or users with access to the containing directory. The command also does not explicitly preserve or enforce restrictive permissions appropriate for secret-bearing data.

### Attack Path

1. An agent is asked to modify an environment file or secret-bearing configuration.
2. The Skill's mandatory backup gate is activated.
3. The agent executes an adjacent copy operation such as `cp .env .env.bak-description`.
4. The plaintext backup remains in the project or deployment directory.
5. A later `git add`, archive operation, build process, artifact collector, backup scanner, or broad file copy includes the newly created file.
6. Parties able to access the repository, artifact, deployment package, or directory can obtain the d
...[truncated 557 chars]

Remediation

View remediation

Remediation Suggestions

1. Exclude .env, credential stores, private keys, tokens, and other secret-bearing files from automatic adjacent backups.
2. Prefer version-control rollback for non-secret tracked files and an approved, encrypted, access-controlled backup system for sensitive files.
3. Require explicit authorization before duplicating potentially sensitive material.
4. If a local backup is necessary, place it outside the repository and deployment context, use a securely generated unique filename, and enforce restrictive permissions such as owner-only access.
5. Preserve or strengthen the source file's security attributes and verify that the backup destination is not shared.
6. Add backup patterns to applicable ignore and artifact-exclusion rules, while recognizing that ignore rules are not a substitute for secure storage.
7. Define a verified retention and secure-deletion procedure so temporary backups do not remain after successful validation.
8. Replace the unconditional rule with a sensitivity-aware backup decision that evaluates confidentiality, rollback options, and downstream collection behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation description is extremely broad and applies to routine engineering tasks such as modifying files, debugging, deployments, and even wording choices. This can cause the skill to trigger across a large share of normal interactions, effectively overriding narrower task-specific skills and steering agent behavior in unintended ways.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "yes"
description: "Use when any task involves modifying files, configs, databases, or deployments. Use when debugging hits 2+ failures. Use when about to guess or assume without evidence ('probably', 'might be', 'I think', 'should be'). Use when deflecting to user ('please check...', 'you should manually...', 'you may need to...'). Use when fixing something without verifying it works. Use when making a conclusion or root-cause claim. Use when skipping tools that are available (has WebSearch but doesn't search, has Bash but doesn't run, has Read but doesn't read). Use when spinning in circles (same approach 3+ times with parameter tweaks). Use when completing a fix without checking for related issues. Use when asking the user a question that could be self-investigated first. Use when giving suggestions instead of actionable code/commands. Applies to ALL task types: debugging, implementation, config, deployment, API integration, data processing. Do NOT trigger on first-attempt failures or when a known fix is already in progress."
---

# YES.md — AI Governance Engine

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill prescribes banned and required phrasing patterns that constrain how the agent must speak, rather than focusing only on security-relevant behavior. This can interfere with user-preferred tone, locale, or higher-priority instruction handling, and may produce rigid responses unrelated to the actual task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction requiring the exact fixed English phrase 'Backing up first.' makes output formatting mandatory regardless of the user's language or context. Fixed-language requirements can violate locale flexibility and create conflicts with system or user instructions about response language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.