skill rules designer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:05 PM UTC
• Version: 1.2.0

Overview

This skill is a disclosed assistant for restructuring and evaluating Claude Code skill files, with user confirmation required before writes.

Install only if you want an agent to inspect and potentially edit skill instruction files. Review the proposed plan before saying go, keep backups or version control for skills being changed, and use the A/B evaluation mode only when you are comfortable with extra workspace files and multiple subagent runs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` (required — stop if missing)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Self-Modification

High

• Category: Rogue Agent

Content

Once confirmed, write in this order to preserve losslessness:

1. Create new `rules/*.md` files with the content they'll receive
2. Update SKILL.md — remove only the content that was written in step 1
3. If enriching: create new template/resource files

Never remove content from SKILL.md until it has been written to its destination file.

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to create files and update SKILL.md, which is self-modification of agent behavior artifacts. Even with a 'lossless' rule and confirmation step, modifying a skill’s own instruction files is high risk because it can persistently alter future agent behavior, propagate mistakes, or introduce unsafe directives into the skill itself.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a skill focused on restructuring SKILL.md content, optimizing rules loading, adding templates/resources, and rewriting vague instructions. Lines L187-L274 instead define a benchmark-results analyzer that reviews benchmark.json across runs, analyzes pass/fail patterns and resource metrics, and writes observational notes, which is a separate evaluation capability not covered by the manifest description.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are broad enough to match common requests like 'help me structure my rules files' or 'make this rule more precise,' which can cause the skill to activate in contexts broader than intended. Overbroad activation is dangerous because it may steer unrelated conversations into file-reading and modification workflows without sufficient necessity.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill’s declared purpose is restructuring a skill’s rules/file layout, but this section introduces a substantially broader A/B evaluation and benchmarking workflow with workspace creation, grading, benchmarking, and reporting. That scope expansion can cause the agent to perform unnecessary multi-step operations and create artifacts beyond the user’s likely intent, increasing the risk of overreach and unintended file changes.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This section directs multi-subagent orchestration, repeated task spawning, artifact persistence, and benchmark generation even though those behaviors are not necessary for basic rules-file design. Such orchestration increases operational complexity, token usage, and the chance of unintended actions across the filesystem, making the skill more capable than its stated mission requires.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The benchmark section states the analyzer's purpose is to surface patterns and anomalies across multiple runs, not suggest skill improvements. Earlier in the same file, the primary workflow explicitly instructs the agent to identify loser weaknesses and generate prioritized improvement suggestions, so the document presents conflicting intent for what this agent should do.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This markdown skill description directs the agent to save results to a JSON file, which is a file-write operation affecting user or system data. The document does not include any warning or disclosure that it will create or overwrite a file at the specified path.

Static analysis

No suspicious patterns detected.