Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` (required — stop if missing)
Security audit
skill rules designer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed assistant for restructuring and evaluating Claude Code skill files, with user confirmation required before writes.
Install only if you want an agent to inspect and potentially edit skill instruction files. Review the proposed plan before saying go, keep backups or version control for skills being changed, and use the A/B evaluation mode only when you are comfortable with extra workspace files and multiple subagent runs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to create files and update SKILL.md, which is self-modification of agent behavior artifacts. Even with a 'lossless' rule and confirmation step, modifying a skill’s own instruction files is high risk because it can persistently alter future agent behavior, propagate mistakes, or introduce unsafe directives into the skill itself.
- Content
md Once confirmed, write in this order to preserve losslessness: 1. Create new `rules/*.md` files with the content they'll receive 2. Update SKILL.md — remove only the content that was written in step 1 3. If enriching: create new template/resource files Never remove content from SKILL.md until it has been written to its destination file.
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill focused on restructuring SKILL.md content, optimizing rules loading, adding templates/resources, and rewriting vague instructions. Lines L187-L274 instead define a benchmark-results analyzer that reviews benchmark.json across runs, analyzes pass/fail patterns and resource metrics, and writes observational notes, which is a separate evaluation capability not covered by the manifest description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough to match common requests like 'help me structure my rules files' or 'make this rule more precise,' which can cause the skill to activate in contexts broader than intended. Overbroad activation is dangerous because it may steer unrelated conversations into file-reading and modification workflows without sufficient necessity.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill’s declared purpose is restructuring a skill’s rules/file layout, but this section introduces a substantially broader A/B evaluation and benchmarking workflow with workspace creation, grading, benchmarking, and reporting. That scope expansion can cause the agent to perform unnecessary multi-step operations and create artifacts beyond the user’s likely intent, increasing the risk of overreach and unintended file changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section directs multi-subagent orchestration, repeated task spawning, artifact persistence, and benchmark generation even though those behaviors are not necessary for basic rules-file design. Such orchestration increases operational complexity, token usage, and the chance of unintended actions across the filesystem, making the skill more capable than its stated mission requires.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The benchmark section states the analyzer's purpose is to surface patterns and anomalies across multiple runs, not suggest skill improvements. Earlier in the same file, the primary workflow explicitly instructs the agent to identify loser weaknesses and generate prioritized improvement suggestions, so the document presents conflicting intent for what this agent should do.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown skill description directs the agent to save results to a JSON file, which is a file-write operation affecting user or system data. The document does not include any warning or disclosure that it will create or overwrite a file at the specified path.
- Content