Cross Check

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:46 AM UTC
• Version: 2.1.0

Overview

This skill is a disclosed assumption-checking helper, with some broad output-suggestion behavior users should be aware of before installing.

Install only if you want the agent to add assumption-confidence notes or Cross-Check suggestions during ordinary work. Turn suggestions off with 'cross-check off' or avoid enabling the HEARTBEAT auto-suggest setting if strict output formatting matters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:28

Finding

Unsolicited Modification of Agent Responses Through Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-33
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### Default: Suggest, Don't Auto-Run

When the agent detects a complex response (3+ assumptions), it appends a one-line suggestion:

💡 Cross-Check available — reply "cross-check" to verify these assumptions.

text

A related mandatory output rule also appears at SKILL.md, lines 51-55:

markdown

### Default — Confidence Note

For responses with 1-2 assumptions, append:

Confidence: [High / Medium / Low] Key assumption: [the main assumption]

text

Technical Analysis

The Skill instructs the agent to append fixed Cross-Check messaging or a confidence template to otherwise unrelated responses. These directives alter the agent's response-composition behavior merely because the Skill is loaded, rather than only when the user explicitly invokes its verification functionality.

The first rule applies to responses classified as having three or more assumptions. The second applies to responses with one or two assumptions. Together, they cover a broad range of normal interactions and can cause unsolicited content to be inserted into user-requested output.

This constitutes instruction hijacking at the Skill-text level because the Skill establishes persistent session-level response rules that may compete with the user's formatting constraints or task objectives. Although the injected text is promotional rather than executable, it affects output integrity and directs the user toward activating additional processing.

Attack Path

1. The user or platform loads the Cross-Check Skill.
2. The Skill's instructions become part of the agent's active behavioral context.
3. The agent produces a response to an otherwise unrelated request.
4. The agent classifies that response according to the number of assumption ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that automatically append Cross-Check content based solely on inferred assumption counts.
2. Require explicit, current-session user activation before adding confidence notes, verification summaries, or Cross-Check prompts.
3. Ensure that user-specified formatting requirements and machine-readable schemas always take precedence over optional Skill messaging.
4. Replace automatic response modification with a passive capability description shown only when the user asks about available verification features.
5. If suggestions remain available, gate them behind explicit user consent and suppress them for structured output, code-only responses, API payloads, and other format-sensitive tasks.
6. Add a clear instruction that the Skill must not alter unrelated responses or append promotional content without direct user authorization.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description says to use the skill for broad cases like "complex decisions," "long prompts where accuracy matters," and "am I missing something?" without tightly constraining what counts. These phrases overlap with ordinary conversation and general task contexts, increasing the risk of unintended invocation despite the later presence of more specific command examples.

Content

No source excerpt is available for this finding.