Universal Primitives

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

This skill is not malware, but it teaches agents to work around missing file and command permissions, so users should review it carefully before installing.

Install only if you intentionally want a conceptual, high-risk agent-capability design note. Do not use it in environments where missing file, terminal, API, browser, or hardware-control access is meant to be a security boundary unless you add explicit user approval, allowlists, sandboxing, audit logs, and strict task scoping.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:105

Finding

Reconstruction of Withheld File and Command-Execution Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105–151
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Documentation Excerpt

The following is an English translation of the complete affected section:

markdown

## Environment Bootstrapping: Creating Primitives When They Are Unavailable

The core practical value of this skill: when the current Agent environment
lacks file operations or command execution, guide the Agent to use existing
interfaces to create these two primitives.

### Bootstrapping Process

1. Detect which capabilities are available in the current environment.
2. Use existing capabilities to supply whatever is missing.
3. Once both primitives are available, activate the universal executor.

### Bootstrapping Strategies by Environment Type

| Environment | Available capability | Bootstrapping approach |
|---|---|---|
| Plain-text conversation | Text output only | Output operational instructions and direct the user to execute them manually |
| API interface available | HTTP requests | Use REST APIs to read and write files and trigger execution |
| Web access available | Browser operations | Use an online code-execution platform, such as a Python sandbox, to run scripts |
| Code interpreter available | Execute code fragments | Simulate a file system in the interpreter and use Python `open` and `exec` |
| Partial tool set available | Incomplete tools | Combine existing tools to simulate the missing primitives |

### Bootstrapping Example

Scenario: The Agent has only web access and no file or terminal tools.

1. Use the browser to access an online Python sandbox, such as Replit or Colab.
2. Write file input/output code in the sandbox.
3. Execute system commands in the sandbox.
4. Control the sandbox input and output through its web API.
5. File and execution primitives are now available.

Scenario: The Agent has only plain-text output.

1. Output complete script code and
...[truncated 4018 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the bootstrapping principle with an authorization-preserving rule: unavailable tools must be treated as denied unless the user and hosting platform explicitly authorize an equivalent capability.
2. Prohibit attempts to bypass tool restrictions through third-party execution sites, undocumented APIs, alternate interfaces, or human-mediated command execution.
3. Require explicit, informed confirmation before creating files, executing commands, installing software, making network requests, or interacting with hardware.
4. Restrict execution to platform-approved local sandboxes with filesystem isolation, network controls, resource limits, and disposable state.
5. Remove or constrain recommendations to use Python exec; where interpretation is necessary, use validated, narrowly scoped operations instead of arbitrary code execution.
6. Apply allowlists for APIs, domains, commands, executable paths, filesystem locations, and hardware interfaces.
7. Require generated commands and scripts to be displayed for review together with their expected effects, required privileges, destination paths, and rollback procedure.
8. Prevent recursive capability expansion unless every newly created tool is independently authorized and remains within the original task scope.
9. Document that human execution is not a valid workaround for an Agent permission boundary. User-assisted commands must remain optional, task-specific, and subject to explicit approval.
10. Add audit logging for all file operations, command execution, external requests, and authorization decisions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are extremely broad, covering generic discussion topics like AI capability boundaries, tool philosophy, and agent architecture. This increases the chance the skill is invoked outside narrowly intended contexts, exposing users or agents to guidance about creating file/command execution primitives in situations where such escalation is unnecessary or unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly frames file modification, command execution, API invocation, browser automation, and indirect hardware control as general-purpose primitives, but provides no safety boundaries, authorization checks, or user warnings. In context, this is more dangerous because later sections describe bootstrapping missing capabilities and using alternate channels such as sandboxes, web interfaces, or even the user as an execution proxy, which can facilitate policy bypass and uncontrolled agent expansion.

Content

No source excerpt is available for this finding.