Security audit

Human Behavior Os

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only behavior analysis skill, but several domain references blur its stated diagnosis-only boundary into A/B testing, metrics, and upsell-readiness guidance.

Install only if you are comfortable with a skill that analyzes user behavior in marketing, product, SaaS, content, and community contexts. It does not run code or access data by itself, but its templates can steer an agent toward testing, metrics, and audience segmentation that may be used to optimize persuasion, conversions, virality, or upsells despite the stated guardrails.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's top-level policy repeatedly forbids use for copywriting, persuasion strategy, or behavior-influencing requests, but the routing table explicitly authorizes a persuasive-copywriting.md reference for 'Copy & communication effect'. That contradiction can cause an agent to load a persuasion-oriented sub-skill despite the declared guardrails, creating a policy-bypass path where diagnostic analysis drifts into messaging optimization or influence assistance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document explicitly says the framework should explain spread outcomes rather than engineer them, but elsewhere provides structures that support experimentation and iterative refinement. This inconsistency weakens the safeguard because users can treat the diagnostic framing as a thin wrapper around actionable spread-optimization analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill repeatedly claims it performs diagnosis only, but the output template includes 'Suggested Investigation Paths' with A/B tests and 'Key Metrics to Track,' which can readily be used to optimize future content spread. That creates a capability gap between the stated safety boundary and the actual operational guidance, enabling users to convert a diagnostic skill into a growth-optimization workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document establishes a safety limitation ('Do NOT provide optimization playbooks') but later contradicts it by endorsing investigation paths that explicitly include A/B testing. That inconsistency weakens guardrails and creates a plausible pathway for users to obtain conversion optimization assistance under the guise of diagnosis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Although the file repeatedly frames itself as diagnostic-only, the 'Suggested Investigation Paths' and 'Key Metrics to Observe' sections cross the line into operational optimization guidance. Recommending A/B tests and ongoing metric instrumentation can materially help improve conversions, which undermines the parent skill's safety boundary against persuasion, growth-hacking, or behavior-change assistance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The reference file crosses the parent skill’s stated boundary of providing diagnostic analysis only by suggesting 'A/B test variable' investigation paths. Even if framed as hypothesis validation, A/B testing guidance can be operationalized into optimization of persuasive messaging, which creates a capability path from diagnosis into influence strategy. In this skill context, that contradiction is more dangerous because the parent explicitly forbids persuasion and growth-hacking outputs, so users may use this sub-skill to launder optimization advice as 'analysis.'
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file states it will never provide revenue optimization strategies, yet later defines structured outputs centered on expansion opportunities and upgrade likelihood. This contradiction weakens safety boundaries and makes it easier for a user to elicit monetization-supporting analysis under the guise of diagnosis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill claims to be diagnosis-only, but the expansion section operationalizes monetization by identifying expansion-ready segments, primary upgrade drivers, and probability estimates. That creates a meaningful bridge from analysis to targeting, enabling downstream revenue optimization or upsell decision-making despite the stated prohibition.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.