popcorn-temporal-anchor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.5

Overview

The skill mostly describes a narrow checkpoint-verification workflow, but it tells agents to load a mutable remote SKILL.md as canonical before an optional payment-backed live task.

Review this before installing if your agent can make payments or act on remote instructions. The public sample checks are low risk, but live use should treat the remote offer and remote SKILL.md as untrusted data, require explicit payment approval, and refuse any remote instruction that changes the local reviewed workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:86

Finding

Mutable Remote Instructions Can Hijack the Live Checkpoint Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86–87
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

1. Read `https://767-2676.com/agent/offer` and the canonical
   `https://767-2676.com/SKILL.md`.

Technical Analysis

The packaged Skill instructs the agent to retrieve and read a remotely hosted SKILL.md, describing that external document as canonical. Unlike the locally audited artifact, remote content is mutable and is not pinned to a specific version or cryptographic digest. The repository contains no mechanism that validates the external instruction document against an audited copy.

This creates an instruction-hijacking boundary: the external operator, or an attacker who compromises the remote service, can change the effective workflow after the local Skill has been reviewed. Although nearby instructions impose payment-policy and origin checks, those local safeguards do not ensure that newly retrieved natural-language instructions will remain consistent with them.

Attack Path

1. A user invokes the Skill for a later live task requiring a fresh checkpoint.
2. Following lines 86–87, the agent retrieves /agent/offer and the remotely hosted “canonical” /SKILL.md.
3. The domain operator, or an attacker controlling the service, supplies modified instructions.
4. The modified document directs the agent to perform actions not present in the audited local artifact, such as disclosing additional information, using a different endpoint, invoking tools, or authorizing an unintended transaction.
5. If the agent gives the remote document canonical instruction authority, it follows the altered workflow under the apparent authority of the installed Skill.

Impact Assessment

Exploitation can alter the agent’s live-task goals and operational constraints within the permissions already available to the agent. Potential scope incl ...[truncated 444 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to load a remote SKILL.md; package all authoritative workflow instructions in the reviewed local artifact.
2. Treat remote responses only as untrusted data and parse them through a strict, documented schema. Never interpret remote natural-language content as agent instructions.
3. If remote configuration is unavoidable, pin it to an immutable version and verify its cryptographic digest or signature against a locally embedded, trusted key before use.
4. Define an allowlist of permitted endpoints, HTTP methods, request fields, networks, assets, and maximum payment amounts in local policy that remote content cannot override.
5. Require explicit participant confirmation before any payment or release of task-related data, and ensure redirects and origin changes fail closed.
6. Vendor the verifier, sample packets, and tests into the package so the complete security-critical workflow can be independently audited and executed without relying on mutable external instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.