Security audit

reson8-phason

Security checks for vulnerabilities and agentic risk

Overview

The skill is only documentation, but it tells an agent to mutate ledger state and replay cached events with broad triggers and limited safety controls.

Install only if you intend an agent to help resolve this specific Reson8-Labs ledger conflict workflow. Before use, narrow the triggers, require explicit user approval before any commit or lock release, and add replay protection, idempotency, audit, and rollback controls for cached events.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad generic phrases such as 'resolve,' 'deadlock,' and 'state conflict,' which can cause the skill to activate in unrelated contexts. Because this skill claims authority to select a winning state, commit to a ledger, and release locks, accidental invocation could lead to inappropriate state mutation or unsafe automation in response to ambiguous language.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documentation describes atomic writes to a ledger and local caching of resolution events without a clear user-facing warning about persistent system and data impact. In a skill designed to operate during conflict states, hidden or under-disclosed side effects are especially dangerous because they can alter authoritative records and create replayable artifacts without informed operator consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Caching phason events in browser localStorage for offline replay is not justified by the stated state-resolution purpose and introduces persistence of potentially sensitive or state-changing data in an insecure client-side store. localStorage is accessible to any script running in the origin, lacks robust access controls, and replaying cached events on reconnect can enable tampering, leakage, or unauthorized reapplication of ledger-affecting operations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest promises resolution 'without re-transmission,' but the later offline replay behavior effectively reintroduces deferred retransmission semantics. This inconsistency is dangerous because operators or upstream systems may trust the skill to avoid replay/network side effects, while it actually persists and replays state-changing events after reconnect, increasing the risk of duplicate commits or unexpected ledger mutation.

Static analysis

No suspicious patterns detected.