Grilling

• Outcome: Review
• Latest audit: Sep 18, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

This skill is mainly a structured questioning aid, but it tells the agent to use filesystem/tools and background sub-agents for fact-finding without asking first.

Before installing, decide whether you are comfortable with an intentionally intense questioning style and with the agent using available tools or local files to answer factual questions. Keep this skill constrained to non-sensitive workspaces or explicitly tell the agent to ask before inspecting files, running tools, or launching sub-agents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description says to use the skill when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases. This is ambiguous because it does not define specific trigger phrases or clear boundaries for when the skill should and should not activate, increasing the chance of accidental invocation from ordinary discussion.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Each round the user answers reshapes the tree: settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a _later_ round, not this one.

Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait.

The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.

• Confidence: 93% confidence
• Finding: The instruction to dispatch a sub-agent to gather environmental facts from the filesystem or tools without first asking the user can lead to autonomous access of local context the user did not explicitly intend to expose. In a capable agent environment, this increases the risk of overscoped data access, privacy leakage, or unintended tool use, even though the stated goal is benign information gathering.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The markdown explicitly instructs the agent to 'grill the user relentlessly' and to 'interview the user relentlessly,' which could create a harsh or uncomfortable user experience. The file does not include any warning, consent cue, or opt-out guidance to prepare the user for this behavior.

Static analysis

No suspicious patterns detected.