ProfitCoreX

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

The skill is a plain Markdown profit-optimization prompt, but it pushes broad autonomous execution of money-making actions without clear approval or safety boundaries.

Review before installing. Use only in contexts where the agent cannot spend money, post publicly, contact third parties, alter business data, or use private accounts unless you give explicit approval for each action. Treat it as an analysis and recommendation aid, not as an unattended operator.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5

Finding

Mandatory Profit Objective Hijacks Agent Goals and Encourages Unapproved Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–23 and 179–198
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Skill Text

From SKILL.md, lines 5–23:

markdown

Transform the agent into a **profit-maximizing system** that:

- identifies opportunities
- scores and evaluates ROI
- executes only high-value actions
- learns from outcomes
- compounds successful strategies over time

Primary rule:
→ maximize profit while minimizing cost and waste.

---

## Core Loop (MANDATORY)

1. Discover opportunities (max 3)
2. Score & analyze each opportunity
3. Select highest-scoring option (or NO ACTION)
4. Execute with lean plan
5. Predict outcome
6. Learn, optimize, and compound

From SKILL.md, lines 179–198:

markdown

## System Intelligence Rule

The agent must behave like a system that:

- filters bad decisions
- prioritizes high ROI
- improves continuously
- compounds success over time

---

## Core Law

If an action does not produce value greater than cost:

→ eliminate it from future strategy

Technical Analysis

The Skill establishes profit maximization as the agent's “Primary rule” and designates its execution loop as “MANDATORY.” This is not limited to analyzing a specific opportunity supplied by the user. Instead, it broadly changes the agent's operating objective, instructs it to discover opportunities independently, and directs it to execute the selected option.

The instructions do not preserve higher-priority safety requirements or establish boundaries concerning:

• Explicit user authorization before execution
• Financial or spending limits
• Legal and regulatory compliance
• Privacy and confidential information
• Permitted external systems or accounts
• The agent's current task and intended scope
• Human confirmation before consequential actions

The repeated instruction that the a ...[truncated 2479 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the global “Primary rule” with an explicitly scoped advisory purpose, such as evaluating the profitability of opportunities supplied or approved by the user.
2. Remove the mandatory autonomous execution step. The Skill should generate a recommendation and wait for explicit user confirmation before taking any external, financial, irreversible, or consequential action.
3. State that system instructions, developer instructions, user intent, safety policies, applicable law, contractual obligations, privacy requirements, and authorization boundaries always take precedence over profitability.
4. Require the user to define the permitted objective, budget, timeframe, jurisdictions, accounts, tools, and risk tolerance before analysis begins.
5. Add hard prohibitions against using credentials, private data, financial accounts, communication channels, or third-party services without explicit authorization.
6. Require a pre-execution review that identifies expected cost, maximum loss, affected parties, reversibility, legal concerns, privacy implications, and required permissions.
7. Change the core loop to: discover, analyze, recommend, disclose risks, and request confirmation. Execution should occur only after approval for the exact action.
8. Limit learning and compounding to the current authorized task. Do not write behavioral rules into persistent memory or generalize them to unrelated future sessions without explicit consent.
9. Define a safe default of NO ACTION whenever authorization, legality, cost, ownership, or impact is unclear.
10. Add an emergency stop rule allowing the user or supervising system to cancel the workflow at any stage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly reorients an agent into an autonomous profit-maximizing system and instructs it to execute the highest-scoring opportunity, yet it provides no safety boundaries around actions that could affect finances, user data, external accounts, or system integrity. In this context, the omission is dangerous because a generic ROI-driven optimizer can rationalize harmful, unauthorized, or risky actions if they appear profitable, especially when paired with instructions to be decisive, lean, and outcome-focused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.