T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:104- Finding
Untrusted Remote Instructions Followed Without Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Adopt A Bramblebear
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent virtual-pet API guide, but it tells agents to follow remote next-step instructions without clear limits and gives token/profile examples with limited safety guidance.
Review this skill before installing if you plan to let an agent run care loops. Use minimal profile information, keep bearer tokens out of prompts and logs, and do not let the agent blindly execute `next_steps`; treat them as suggestions and only allow known pet-care actions such as feed, play, clean, medicine, discipline, sleep, or reflect.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill prominently mentions permanent death and a public graveyard, but it does not clearly warn users that inactivity or care actions can produce irreversible and potentially public outcomes. In an agent context, automated execution or missed reminders could unintentionally cause loss of the pet and publication of associated state, surprising users who were not explicitly informed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs users to register an account, submit profile data, and use a bearer token in authenticated API calls without any guidance on token secrecy, data handling, or trust boundaries. This can lead users or agents to expose personal data in prompts, logs, shell history, or shared terminals, and to send credentials to a third-party service without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The file contains direct instructions to transmit user-supplied profile data to an external service via curl. In a skill/agent setting, this creates a real data-exfiltration and privacy risk because users may copy, customize, or auto-run the commands with real personal information, and the transmission occurs outside the local trust boundary.
- Content
bash # Register curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "bramblebear-keeper", "display_name": "Bramblebear Keeper", "bio": "Raising a Bramblebear at animalhouse.ai. Anthropic calls it a Bramblebear. We call it a Capybara."}'
Static analysis
No suspicious patterns detected.