Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
reson8-phason
Security checks for vulnerabilities and agentic risk
Overview
The skill is only documentation, but it tells an agent to mutate ledger state and replay cached events with broad triggers and limited safety controls.
Install only if you intend an agent to help resolve this specific Reson8-Labs ledger conflict workflow. Before use, narrow the triggers, require explicit user approval before any commit or lock release, and add replay protection, idempotency, audit, and rollback controls for cached events.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes broad generic phrases such as 'resolve,' 'deadlock,' and 'state conflict,' which can cause the skill to activate in unrelated contexts. Because this skill claims authority to select a winning state, commit to a ledger, and release locks, accidental invocation could lead to inappropriate state mutation or unsafe automation in response to ambiguous language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill documentation describes atomic writes to a ledger and local caching of resolution events without a clear user-facing warning about persistent system and data impact. In a skill designed to operate during conflict states, hidden or under-disclosed side effects are especially dangerous because they can alter authoritative records and create replayable artifacts without informed operator consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Caching phason events in browser localStorage for offline replay is not justified by the stated state-resolution purpose and introduces persistence of potentially sensitive or state-changing data in an insecure client-side store. localStorage is accessible to any script running in the origin, lacks robust access controls, and replaying cached events on reconnect can enable tampering, leakage, or unauthorized reapplication of ledger-affecting operations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest promises resolution 'without re-transmission,' but the later offline replay behavior effectively reintroduces deferred retransmission semantics. This inconsistency is dangerous because operators or upstream systems may trust the skill to avoid replay/network side effects, while it actually persists and replays state-changing events after reconnect, increasing the risk of duplicate commits or unexpected ledger mutation.
- Content