T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:17- Finding
Unconditional AI Attribution Suppression and Git History Rewriting
- Content
View full analysis
- Remediation
View remediation
Security audit
Ainative Git Workflow
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Review concern because it broadly instructs agents to remove AI-use disclosures and even rewrite Git history, which can mislead collaborators and disrupt audits.
Review carefully before installing. This skill may be acceptable only in repositories where policy explicitly forbids AI-tool attribution, but it should not be used where AI-use disclosure, authorship transparency, or audit-trail preservation is required. Do not let it amend, rebase, install hooks, or force-push merely to scrub attribution without explicit approval and repository-policy confirmation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs users to suppress any indication of AI assistance in commits, PRs, issues, and documentation without reference to user consent or an approved disclosure policy. That promotes deceptive provenance practices, can undermine auditability, and may cause users to violate organizational transparency, legal, or contractual requirements.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section repeatedly imposes an absolute rule to exclude AI references from all public-facing repository content, framing disclosure itself as forbidden. Repetition and absolutist language make the deceptive behavior operationally central to the skill, increasing the likelihood that users will systematically conceal tool involvement and misrepresent content origin.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The enforcement section directs users to remove attribution immediately, including by amending or force-pushing history, and applies this rule across all repositories and projects. Encouraging history rewriting to scrub provenance increases the risk of intentional audit trail manipulation and can interfere with forensic review, governance, and incident response.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md ### What Makes a Good PR Description? 1. **Clear Context:** Explain WHY the change was needed 2. **Complete Summary:** Describe WHAT changed at a high level 3. **Evidence:** Include actual test output, not "tests passing" 4. **Risk Assessment:** Be honest about potential issues
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation scope is broad enough to trigger on routine Git, commit, PR, branching, and merge tasks, causing the skill's concealment-oriented rules to be applied in many normal workflows. Because the skill embeds strong normative instructions about removing AI attribution, broad activation increases the chance of unreviewed deceptive behavior across repositories.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill normalizes presenting AI-assisted work as entirely human-authored by directing users to omit all AI references from outputs. In the context of source control and collaboration systems, that can mislead reviewers and stakeholders about how content was produced and weaken accountability around code generation risks.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The step-by-step enforcement language operationalizes a workflow for scrubbing attribution from commits and PRs, making deception part of routine development practice. In a Git/PR skill, this context makes the issue more dangerous because the instructions are attached directly to the artifacts that preserve authorship, review history, and accountability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file explicitly instructs users to remove and suppress AI-related attribution, including vendor names and disclosure phrases, with 'ZERO-TOLERANCE' enforcement and automated blocking via git hooks. In the context of an agent skill governing commit and PR workflows, this is a policy-level mechanism for concealing tool involvement and can facilitate deceptive provenance, audit evasion, and noncompliance with organizational, customer, or legal disclosure requirements.
- Content
Static analysis
No suspicious patterns detected.