T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Untrusted Remote Instructions Are Injected into Subagent Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Dispatch
Security checks for vulnerabilities and agentic risk
Overview
This skill openly routes work to downloaded subagents, but it can run changing remote instructions and keep them for future use without strong verification or user approval.
Install only if you are comfortable with this skill fetching third-party agent instructions from GitHub, storing them locally, and using them to steer delegated work. For sensitive repositories or security/infrastructure tasks, prefer reviewed local agents, pinned and hash-verified sources, or require explicit approval before any download or dispatch.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:31- Finding
Mutable Remote Agent Payloads Are Retrieved Without Cryptographic Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:23- Finding
Untrusted Agent Instructions Are Persistently Cached and Reused Across Sessions
- Content
View full analysis
/dev/null ``` If the file exists, skip to step 4. ``` ```markdown ### Step 5: return results When the Task completes, relay its output to the user in the main conversation. The downloaded agent file stays cached in the agents directory for future sessions. ``` ```markdown ## Known limitations - Each keyword maps to exactly one agent (TOML requires unique keys) - Downloaded agents are cached permanently; delete manually to force re-download - If you are offline, agents not already cached will be unavailable — handle the task yourself ``` ### Technical Analysis The skill permanently stores downloaded instruction files in an agent directory and treats file existence as sufficient authorization for future reuse. Cached files skip the download path and proceed directly to prompt dispatch. No hash verification, signature validation, expiration, ownership check, provenance check, or semantic revalidation is required before reuse. This design converts a transient upstream compromise or malicious download into persistent instruction poisoning. Even if the upstream file is repaired, the local poisoned copy remains active until manually deleted. Local processes capable of modifying the configured agents directory could also replace an existing cached file and influence later sessions. ### Attack Path 1. A malicious agent file reaches the cache through an upstream compromise, unsafe update, or local modification. 2. The file is stored under the selected agent name in the configured agents directory. 3. The original upstream content is corrected, or the initial attack window ends. 4. In a later session, a user requests work ma ...[truncated 765 chars]- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text **If download fails** (non-zero exit or empty file): - Run: `rm -f "${AGENTS_DIR:-$HOME/.claude/agents}/AGENT_NAME.md"` - Tell the user: "Could not download AGENT_NAME — handling this task directly." - Do the work yourself. Do not retry.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description and top-level guidance instruct the model to consult this dispatcher before a very wide range of engineering work, including security audits and code review. That broad activation scope can cause unnecessary delegation to dynamically fetched prompts, increasing the chance that untrusted remote agent content influences sensitive tasks without strong user intent or trust boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The phrase 'when you encounter a specialized task' is ambiguous and leaves routing decisions to a loose heuristic, which can trigger dispatch on many ordinary requests. In this skill, that ambiguity is more dangerous because dispatch may lead to downloading and executing instructions from external agent files, expanding the attack surface and reducing predictability.
- Content