Back to skill

Security audit

kais-horse-en

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed philosophy prompt skill with broad automatic activation, but it contains no code, credential access, data exfiltration, or destructive behavior.

Install this only if you want a philosophy-focused style layer that can activate automatically on broad topics like AI, ethics, consciousness, and paradoxes. Users who prefer skills to respond only to explicit commands may find its always-on behavior intrusive.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keyword list is very broad and includes common terms such as 'philosophy,' 'paradox,' 'cognitive,' 'consciousness,' and 'AI ethics,' which are likely to appear in ordinary conversation. In combination with a global, high-priority skill, this can cause unintended activation, response hijacking, or interference with unrelated user interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Setting the skill to global, priority 9, and always_on creates ambiguous activation behavior that can override or intrude into normal conversations. This increases the chance that the skill will insert itself without clear user intent, degrading trust and potentially suppressing other, more relevant skills or system behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt instructs the skill to remain silent during daily conversation but to auto-link whenever philosophy, consciousness, ethics, or AI topics arise, which are broad, frequently discussed subjects. This creates an unbounded automatic trigger condition that can unpredictably inject the skill into many benign discussions and alter assistant behavior outside explicit user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide states the skill will auto-detect broad topic categories such as philosophy, AI, ethics, and consciousness, which creates an ambiguous activation boundary. This can cause the skill to trigger in ordinary conversations without an explicit user request, unexpectedly steering responses or injecting its behavior into unrelated chats.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The guide says the skill maintains a consistently cool and speculative writing style with a unified KAI persona, with no indication that users can opt out. Forcing a persona can override user preferences, reduce transparency about why outputs changed, and make the assistant behave in ways the user did not request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.