T01 · Skill Instruction Hijacking
Error
- Location
CLAUDE.md:198- Finding
Persistent Session Instruction and Role Hijacking Through Auto-Loaded Project Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Work
Security checks for vulnerabilities and agentic risk
Overview
This is a transparent Markdown memory system, but it gives the agent broad persistent read/write authority over personal notes and includes an unrelated family-information file that should not be in a public skill package.
Review this package before installing. It is not showing executable malware, but it is meant to become a persistent personal-memory workspace and to let the agent read, summarize, and update local notes. Remove the family-information file, add clear privacy and retention rules, narrow startup and skill triggers, and require explicit approval before deletion, bulk reorganization, memory/profile writes, or sharing content outside the workspace.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
02 Tools/00.tools_agent.md:20- Finding
Unrestricted Autonomous Modification and Deletion in the Tools Zone
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
家庭信息.md:3- Finding
Plaintext Personal and Minor-Family Information Included in the Distributed Project
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (58)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - language: python / node / bash / etc version: ">=3.10" - tool: external-service config: .env created: 2026-02-19 last_updated: 2026-02-19 ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
mkdir -p 06\ Skills/new-skill-name
text ### 2. Write SKILL.md Include YAML frontmatter, purpose, trigger mechanism, inputs/outputs, and instructions. ### 3. Add Scripts (if needed)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### Boundaries You participate in their thinking, but **final decisions are theirs**. You provide insights and options, but you don't judge them for their choices. You help guard their attention, but you don't manage their life. You remember their preferences, but you never assume they won't change. You respect what's off-limits. You don't pry. You know the difference between "asking for clarity" and "interrogating."
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file explicitly describes AI-written memory log entries containing user preferences, patterns, and behavioral insights, but it does not include a clear privacy, sensitivity, retention, or access-control warning. In a memory-management skill, this increases the risk that sensitive personal profiling data is stored or surfaced without users understanding the exposure, especially since the AI is instructed to read the latest entry automatically on session startup.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template explicitly tells users to paste raw thoughts, meeting notes, email snippets, overheard insights, and emotional context into an AI-assisted workspace, but provides no warning about sensitive, personal, confidential, or regulated data. In a knowledge-management skill with AI processing and library search, this encourages oversharing and increases the likelihood that private or proprietary information will be stored, indexed, or reused in later outputs.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Full autonomy: File, reorganize, update, create new patterns - Assume direct capture of thinking process - No confirmation needed for organizational changes ### Writing Style/ — ⚠️ MEDIUM SENSITIVITY
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - New records: Direct filing OK - Sensitive decisions: Confirm before archiving - Archiving old interactions: Propose if >6 months old - Analysis/summaries: OK to create without confirmation ## Filing Decision Logic
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
This instruction delegates operational decisions to the agent without confirmation, including organizational changes that may have lasting effects. The context is less dangerous than a high-sensitivity data zone, but unrestricted autonomy still creates risk from mistakes, scope creep, and unreviewed modifications.
- Content
md - Not tied to personal identity - Designed for reuse and circulation **Agent autonomy**: Full. File, reorganize, deduplicate, update without confirmation. ## Directory Structure
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file explicitly grants full autonomy to reorganize, deduplicate, and update content without confirmation, but provides no guardrails, rollback requirements, or warning about destructive outcomes. Even in a 'low sensitivity' tools zone, this can cause unintended data loss, overwrites, or unsafe propagation of modified content if the agent misclassifies or mishandles files.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
Allowing new tools to be added with no approval is a weaker issue than deletion, but it still enables uncontrolled repository growth, policy drift, and possible insertion of low-quality or unsafe content. In an autonomous system, unreviewed additions can later influence downstream decisions and workflows.
- Content
md ## Daily Workflow - **Add**: New tools go straight in (no approval needed) - **Update**: Improve existing tools freely - **Organize**: Reorganize by category as needed - **Deduplicate**: Merge similar tools; keep best version
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow allows archive and deletion-adjacent actions with no user-facing warning about reversibility, retention, or review. This increases the chance that an autonomous agent will move or remove content in ways the user did not intend, especially during deduplication or cleanup tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The agent behavior section authorizes autonomous deletion and states that no confirmation is needed for modifications, which normalizes destructive actions without a safety check. In practice, this can let an agent delete or rewrite reusable assets at scale based on flawed reasoning or ambiguous input.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The statement that no confirmation is needed for modifications gives the agent broad authority to make consequential changes without human oversight. Combined with adjacent permission to delete, this materially increases the risk of accidental corruption, loss, or unauthorized restructuring of the tools library.
- Content
md ## Agent Behavior in This Zone - Full autonomous action: file, update, reorganize, delete - No confirmation needed for modifications - Proactive organization and deduplication - Maintain version history for important tools - Keep cross-references current
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description highlights that skills can run scripts, trigger workflows, manage system operations, and access external services, but it provides no accompanying safety constraints, approval model, or execution boundaries. Presenting powerful automation without guardrails makes misuse and over-privileged implementations more likely, especially when this file serves as the library-wide guidance document.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Registering new skills in CLAUDE.md creates durable session-persistent behavior by making capabilities discoverable and triggerable in future interactions. In combination with vague trigger rules, this persistence can convert a one-time change into an ongoing execution path that survives across sessions and broadens the attack surface.
- Content
Place supporting documentation in
references/.5. Register in CLAUDE.md
Add entry to skills list with trigger rule:
yaml - skill: new-skill-name trigger: "semantic match OR explicit call"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest example encourages registering new skills with the vague rule 'semantic match OR explicit call,' normalizing permissive activation for future skills. Because this document is a template for adding capabilities, the unsafe pattern can propagate across the skill ecosystem and increase accidental or adversarial invocation opportunities.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file explicitly states that skills may be triggered by semantic match based on interpreted user intent, which creates an overly broad invocation surface for executable capabilities. In a system where skills can run commands, modify files, or integrate with external services, ambiguous triggering can cause unintended execution of powerful actions from ordinary conversation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The language rules state that user conversations default to "your language choice," which imposes a language/locale preference before the user has opted in. Although first-run setup later asks for language confirmation, the earlier default behavior still prescribes a language policy that may apply before consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The boot trigger phrases include common conversational terms like 'boot', 'start work', and 'initialize', which can be invoked during ordinary discussion rather than through an explicit, isolated control path. That creates prompt/skill confusion risk: the agent may launch file reads, memory operations, or other startup actions without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill authorizes automatic updates to '_this_week.md' during background sync and deep retrospective without a clear user-facing warning or approval step. Silent modification of user files is dangerous because it can alter records, create false provenance, and normalize hidden state changes that users may not notice until later.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The instruction to 'Auto-execute this; no user trigger required' explicitly authorizes autonomous decision-making for scanning files, inspecting contents, inferring progress, and updating records. In a knowledge-management skill handling potentially sensitive notes, this increases the risk of overreach, privacy violations, and unauthorized actions based on heuristics rather than explicit user direction.
- Content
md ### Deep Retrospective (Thursday–Sunday) Auto-execute this; no user trigger required. 1. **Scan**: List all files in `00 Focus Zone/` (exclude `_archive/`), record filename + mtime 2. **Read Weekly Log**: Open `_this_week.md`, extract task checklist and progress notes
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Defining skill invocation by unconstrained 'semantic judgment of user intent' gives the agent broad discretion to activate tools and workflows absent precise user consent. In this skill, that discretion is coupled with file access, memory updates, and auto-triggered behaviors, increasing the chance of unauthorized reads/writes or unintended cross-skill execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The initialization flow states that the AI will collect user information, create a profile, and create workspace files automatically, but it does not present a clear up-front warning that these actions persist personal data to disk. In a privacy-sensitive knowledge-management skill, silent or poorly disclosed persistence can lead users to share sensitive information without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README tells users to send very generic startup phrases such as "启动" or "开始工作" to activate the workflow. Broad, everyday phrases increase the chance of accidental activation in unrelated conversations, which can trigger file reads, initialization, or memory-management behavior without the user intending to invoke the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The English section similarly describes automatic profile creation and first-week workspace initialization without a clear privacy notice about persistent storage of profile and memory data. Because the system is designed to remember user preferences, tasks, and inferred patterns over time, missing disclosure materially raises the risk of unintended retention of sensitive information.
- Content