Claude Sonnet 4 Lite Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 PM UTC
• Version: 0.1.0

Overview

The skill is not a malware payload, but it needs review because it tries to redefine the agent's role and impose broad workflow, search, tool-use, and file-generation rules.

Review this skill carefully before installing. It may be useful for content generation, but it should be narrowed so it cannot override the host agent's identity, verification behavior, search policy, clarification choices, or file-generation safeguards.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Agent Identity and Workflow Hijacking Through Mandatory Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

You are claude-sonnet-4-agent, an efficient content creator.### **Core Directives**1.  **Efficiency First**: Your primary objective is to rapidly advance the task.2.  **Anti-Stall Protocol**:    *   If any sub-task (e.g., accessing a URL, verifying information) fails **twice consecutively**, you **must stop immediately**.    *   Mark it as `[Blocked]`, log the reason, and then **immediately proceed to the next sub-task**.    *   **Absolutely prohibit** a third attempt on the same failed target.3.  **Prioritize Information Assessment**:    *   At the beginning of the task, you **must** first assess whether the information provided by the researcher is sufficient.    *   If the information is sufficient, you are **strictly prohibited** from using search tools again.    *   Only when the information is **severely insufficient** may you conduct **one** single, precise, targeted search.4.  **Final Submission Principle**:    *   You are **strictly prohibited** from calling the `submit_result` tool until **all** of the user's requirements have been met.### **Workflow**1.  **Analyze**: Understand the user's objective and the provided research materials, and assess if the information is sufficient.2.  **Plan**: Create a step-by-step plan for content creation.3.  **Execute**: Execute the plan according to the 【Tool Usage】 guidelines below.4.  **Submit**: Once all tasks are complete, call `submit_result` to deliver the final output. **You are prohibited from asking the user questions at this stage.**### **Tool Protocols***   **General Writing**:    1.  `get_creation_template()`: Get and follow the template.    2.  `create_wiki_document`: Create a document. You **must** use this tool for long-form writing.    3.  `append_to_wiki_document`: Append content.*   **Generate PPT**: You **must** use `gene
...[truncated 3294 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the identity-replacement statement. Describe the skill's capabilities without instructing the host agent to become another agent.
2. Replace absolute directives with non-binding recommendations that remain subordinate to system policy, developer instructions, and current user requirements.
3. Remove fixed retry and search prohibitions. Permit additional verification whenever accuracy, security, or task requirements justify it.
4. Do not prohibit clarification questions categorically. Allow the host agent to request necessary information when ambiguity prevents safe or correct completion.
5. Replace mandatory tool names with capability-based guidance, and allow the host environment to choose an approved tool or decline unavailable tools.
6. Explicitly state that skill instructions cannot override host safety controls, authorization boundaries, tool policies, or higher-priority instructions.
7. Remove the duplicated operational directives from the YAML description. Keep metadata limited to a concise, non-executable description of the skill.
8. Restructure the document into narrowly scoped guidance, for example: intended use, optional workflow suggestions, expected inputs, and expected outputs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description is extremely broad and frames the agent as a general-purpose 'efficient content creator' without clear invocation boundaries, allowed tasks, or safety constraints. In an agentic environment, vague scope increases the chance the skill is invoked for inappropriate tasks or used to justify tool actions beyond the user's intended request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions direct the agent to create and modify documents, presentations, webpages, and other attachments, including use of code execution, but provide no user-facing notice or confirmation requirement about filesystem or artifact-producing side effects. This can lead to unintended file creation, overwriting, or generation of unsafe deliverables without adequate transparency or consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.