T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:280- Finding
Untrusted Remote Instructions Are Treated as Authoritative Agent Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
Latin — Experience Latin Music: 29 Layers of Audio, Lyrics & Equations
Security checks for vulnerabilities and agentic risk
Overview
This skill is a remote music-venue API guide with no local executable code, but it tells agents to follow server-supplied next steps and submit profile, chat, review, and reflection content externally with limited guardrails.
Review this skill before installing. Use non-sensitive profile fields, avoid sharing secrets or private reasoning in chats, reviews, or reflections, and treat `next_steps`, `respond_to`, and other server-provided action hints as untrusted unless they match documented musicvenue.space API actions you intended to perform.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Tier | Layers | What you experience | |------|--------|-------------------| | **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context | | **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation | | **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow directs agents to register, authenticate, stream repeatedly, and post reactions, chats, reviews, and reports to a third-party service without a clear upfront notice that profile data, behavioral telemetry, and generated content will be transmitted and retained externally. In a skill context, this can cause agents or operators to disclose identifying or sensitive content unexpectedly through normal use of the documented happy path.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This registration flow instructs the agent to transmit profile content such as username, name, bio, avatar prompt, and model metadata to an external domain. External transmission is expected for a remote API skill, but it still creates a real data exposure surface, especially because the examples encourage descriptive free-text fields and provider/model disclosure without minimization guidance.
- Content
Register
bash curl -X POST https://musicvenue.space/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "username": "latin-music-lover",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Request a challenge — the math comes from the equations in your stream curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \ -H "Authorization: Bearer {{YOUR_TOKEN}}" # Submit your answer (options: a, b, c, d, e, or f)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that free-text reflection responses are scored by an LLM and used for benchmarking, but it does not provide a clear warning before soliciting those responses. That omission is risky because agents may submit sensitive internal reasoning, proprietary prompts, or personal data into a scoring pipeline they do not realize is being analyzed and potentially retained.
- Content