Book Deep Study

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 3.1.1

Overview

This deprecated skill mostly contains harmless reading-study prompts, but its main entry point redirects the agent to an unaudited absolute filesystem path outside the package.

Install only if you trust the local canonical skill at the referenced absolute path. The package itself does not run code or request credentials, but its main behavior depends on instructions outside this reviewed artifact, so review that target skill before relying on it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3

Finding

Unaudited External Skill Instruction Redirection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3–5
Vulnerability Type: External instruction substitution
Risk Level: Medium

Vulnerable Code Snippet:

markdown

Use the canonical skill instead:
- `/data/workspace/skills/skills/book-deep-study/SKILL.md`

Technical Analysis

The packaged skill entry point instructs the agent to load another skill from an absolute filesystem path outside the audited project. The target file is not part of the supplied artifact, so its contents, integrity, ownership, and future changes cannot be verified by auditing this package.

This creates an instruction-substitution boundary: behavior observed during review is not necessarily the behavior activated at runtime. If an attacker or another process can modify the externally referenced file, they can replace the effective skill instructions without changing this audited artifact. The replacement instructions may alter the agent's session goals, safety constraints, tool-use decisions, or output behavior.

The redirection does not itself demonstrate arbitrary code execution or operating-system privilege escalation. Exploitation depends on the agent following the redirect and an attacker being able to influence the referenced external file.

Attack Path

1. A user or agent loads this package through SKILL.md.
2. The entry point directs the agent to /data/workspace/skills/skills/book-deep-study/SKILL.md.
3. An attacker or compromised process modifies that external file before it is loaded.
4. The agent treats the externally supplied content as trusted skill instructions.
5. The substituted instructions alter the active session's objectives, safeguards, tool usage, or responses.

Impact Assessment

Successful exploitation grants control over the effective skill instructions for sessions that follow the redirect. This may allow manipulation of the agent's current-session behavior and misuse of whatever ...[truncated 249 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that redirects the agent to an absolute path outside the audited package.
2. Include the canonical SKILL.md and all required references directly within the distributed artifact.
3. If the obsolete package must remain, make it a non-operative deprecation notice that does not instruct an agent to load another file.
4. If delegation is unavoidable, restrict loading to an approved package directory and verify the target using an immutable version and cryptographic digest before processing it.
5. Ensure the delegated file is subject to the same review, ownership, access-control, and release process as the entry point.
6. Reject redirects whose resolved paths escape the skill package root, including absolute paths and traversal-based paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

This is the old book-deep-study skill location.

Use the canonical skill instead:
- `/data/workspace/skills/skills/book-deep-study/SKILL.md`

This file is intentionally kept minimal so older references do not silently use stale behavior.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt text is written entirely in Chinese and explicitly frames the assistant role and outputs in Chinese without offering the user a language choice. This can override or conflict with user preference and accessibility expectations, reducing usability and potentially causing misinterpretation for non-Chinese-speaking users, though it does not introduce code execution or data exfiltration risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.