Graph Of Thoughts

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:34 AM UTC
• Version: 2.0.0

Overview

This skill is a mostly documented reasoning workflow with no evidence of hidden exfiltration, destructive behavior, or privilege escalation, though users should be aware of its optional caching and memory guidance.

Install only if you want a structured reasoning template. Treat caching, memory logging, and example creation as optional, and disable or avoid them for confidential prompts unless you are comfortable retaining those details locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill’s stated purpose is reasoning/synthesis, but the supplied documentation also describes behavior that crosses into execution and references implementation capabilities not actually visible in the provided file. That mismatch is dangerous because users and orchestrators may grant the skill broader trust than warranted, creating a pathway for hidden or delegated code to run under an innocuous reasoning label.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documented algorithm explicitly includes an 'execute_and_verify' phase, meaning the skill is not limited to internal reasoning but may carry out generated solutions. In a reasoning skill context, this is risky because model-produced plans can be unsafe, and execution of synthesized outputs can turn a prompt-level mistake into real side effects on files, systems, or external resources.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: This markdown file defines invocation-style phrases like "combine [thoughts]", "synergy [paths]", and "feedback [solution]" but does not state where these commands are valid, whether they must be prefixed in a specific tool, or any exclusion conditions. Terms like "combine" and "feedback" are common natural language words, so the lack of scope constraints could lead to unintended activation collisions.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The caching design stores problem-derived keys, paths, evaluations, and final results for later reuse, which introduces retention of potentially sensitive user inputs and model outputs beyond a single session. In a reasoning-oriented skill, undocumented persistence increases privacy and data handling risk, especially if similar-problem reuse causes cross-session leakage or exposes prior context to later tasks.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

# Find the main class
            for name in dir(module):
                obj = getattr(module, name)
                if isinstance(obj, type) and name != "UnifiedSkill":
                    self._original = obj()
                    break

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.