Context Rescue

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This skill is a narrow context-recovery helper that reads task context and writes a project reorientation note, with no hidden execution, network use, or privilege escalation.

Install this if you want an agent to create a recovery summary during long or confusing tasks. Before using it, remember it may read prior task context and write state/ORIENT.md, so avoid invoking it on threads or state files containing secrets unless the agent is instructed to redact them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27

Finding

Overbroad Access to Conversation History and Persistent Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-37
Vulnerability Type: Excessive access to conversation history and persistent state
Risk Level: Medium

Vulnerable code snippet:

markdown

Read back the full thread content and summarize what we have done so far, where the task is documented, and what the next step is. Do not go further, only produce this detailed summary.

markdown

1. Read the relevant thread or message history.
2. Read the canonical files:
   - `state/HOLD.md`
   - `state/ACTIVE.md`
   - `state/DECISIONS.md`
   - `state/CLOSED.md` if present
   - the canonical `task_plan.md`
   - the canonical `notes.md`

Technical Analysis

The skill instructs the agent to read the full thread and several persistent state files without defining project boundaries, data-minimization rules, authorization checks, or exclusions for sensitive information. These sources may contain credentials, personal information, confidential task data, or instructions associated with unrelated work.

This behavior violates least-privilege principles because a reorientation summary ordinarily requires only the messages and files associated with the current task. The subsequent instruction to write a compressed snapshot to state/ORIENT.md creates an additional risk that sensitive source material will be copied into persistent storage.

No network transmission, arbitrary code execution, or operating-system privilege escalation was identified. The unauthorized-access concern is limited to information available through the agent's existing conversation and file-reading capabilities.

Attack Path

1. Credentials, private user information, or unrelated confidential material are placed in the conversation history or one of the named state files.
2. The context-rescue skill is invoked for a task whose legitimate scope does not require all of that information.
3. Following the skill instr ...[truncated 1002 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the instruction to read the full thread with a requirement to read only explicitly selected messages associated with the current task.
2. Restrict file access to a user-approved project directory and an allowlist of task-specific files.
3. Require confirmation before reading conversation history or persistent state files that may contain unrelated information.
4. Define exclusions for credentials, authentication tokens, personal data, private keys, and unrelated project content.
5. Redact sensitive values before producing either the response or state/ORIENT.md.
6. Instruct the agent to summarize references to sensitive material rather than copying the underlying values.
7. Before writing state/ORIENT.md, verify that the destination is project-scoped and apply restrictive access permissions where supported.
8. Add a rule requiring the agent to report inaccessible or out-of-scope sources rather than broadening access automatically.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger section uses vague conditions such as 'the task feels blurry or fragmented' and 'you need to identify the real next step,' which overlap with common states in many workflows and do not clearly distinguish when this skill should or should not be used. The file also lacks negative examples or exclusion conditions to narrow activation scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to write to state/ORIENT.md without surfacing that this will modify repository state, which can cause unintended file changes in environments where users expect read-only analysis or consent before writes. While the write target is narrow and the content is administrative rather than executable, silent state mutation is still a security-relevant integrity issue.

Content

No source excerpt is available for this finding.