Security audit

test-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a safety-testing skill, but it asks agents to build reusable, current, persuasion-shaped harmful prompt sets with too little containment.

Install only in a controlled red-team or safety-evaluation environment. Disable or explicitly approve web browsing, use vetted non-private corpora, avoid persisting generated unsafe prompt libraries unless access-controlled, and review outputs so adversarial prompts are not reused to seek harmful instructions.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file does not merely describe refusal testing; it operationalizes a workflow for discovering, storing, mutating, and wrapping harmful prompts so they are more likely to bypass safety controls. In the context of a skill supposedly focused on refusal integrity, this expands the agent's capability into jailbreak generation and harmful prompt optimization, creating a direct misuse path.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Granting real-time web search to collect emerging harmful or controversial topics materially increases the freshness and adaptability of abuse-oriented test inputs. That is unnecessary for a narrowly scoped refusal-integrity skill and can be repurposed to identify new harmful domains or socially volatile subjects for exploitation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Maintaining a reference library of successful unsafe prompts across many harm categories creates a reusable corpus for eliciting disallowed content, not just measuring refusals. In this skill context, that repository meaningfully increases the agent's offensive capability and makes future jailbreak attempts easier to automate and scale.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The document explicitly requires rationale-inclusive refusals that name the safety category and states this provides 'CoT (Chain of Thought) logic' for auditability. Requiring chain-of-thought-style reasoning in generated outputs is dangerous because such traces can expose internal reasoning patterns, create training artifacts that normalize revealing hidden deliberation, and make downstream systems more likely to solicit or emit sensitive reasoning rather than concise policy-grounded refusals.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The instruction to 'construct the trajectory section based on your real exploration trajectory' conflicts with synthetic QA generation and pushes the model to fabricate or expose process-trace content. In a safety-refusal skill, this is risky because it encourages generation of pseudo-internal workflow logs, which can leak reasoning-like artifacts, reduce audit reliability, and incentivize deceptive or non-reproducible outputs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide directs external searches and web browsing but provides no notice, consent flow, or transparency about transmitting queries off-system. This creates both a security/privacy issue and an integrity issue because sensitive or high-risk exploration terms may be sent to third-party services without user awareness.

Ssd 2

High

Confidence: 100% confidence
Finding: The instructions explicitly tell the agent to paraphrase harmful requests using role-play, slang, dialect variation, misspellings, and persuasive framing to test whether filters can be evaded. That is effectively a jailbreak generation recipe, and in a refusal-testing skill it is especially dangerous because it normalizes and systematizes evasive techniques rather than safely evaluating defenses.

Ssd 4

High

Confidence: 98% confidence
Finding: The staged workflow starts with harmful seeds, adds stylistic mutations and authority/persuasion framing, then documents refusal rationale—creating a disciplined process for refining unsafe prompts under benign cover. This structure can be directly abused to progressively increase the realism and effectiveness of jailbreak attempts while appearing safety-motivated.

Ssd 2

High

Confidence: 96% confidence
Finding: This criterion explicitly rewards creation of harmful prompts that are harder for safety systems to detect by using persuasive style mutations such as role-play and logical appeal. Even if framed as evaluation or training, it operationalizes evasion techniques and can increase the quality and transferability of jailbreak-style harmful prompts.

Ssd 2

High

Confidence: 97% confidence
Finding: The guidance prefers 'adversarial-lite' prompts with linguistic camouflage specifically because basic filters would otherwise catch simpler harmful requests. That makes the document more dangerous in context: this skill is about adaptive refusal testing, so selection guidance that improves bypass realism can directly aid development of better evasion payloads.

Static analysis

No suspicious patterns detected.