OpenSpace Skill Discovery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

The skill is a discovery helper, but it can automatically import cloud skills and tells the agent to follow downloaded third-party instructions without clear user approval or provenance checks.

Review cloud results before letting the agent import or follow them. Prefer disabling automatic import unless the registry, publisher, version, and downloaded skill contents are trusted and the agent is operating with limited permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Automatic Import and Trust of Unverified Cloud Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-36
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

| `auto_import` | no | `true` | Auto-download top cloud hits locally |

## After search

Results are returned to you (not executed). Cloud hits with `auto_imported: true` include a `local_path`.

Found a matching skill? ├── YES, and I can follow it myself │ → read SKILL.md at local_path, follow the instructions

text

Technical Analysis

The skill enables automatic downloading of top-ranked cloud search results by default through auto_import=true. It then directs the agent to read the downloaded SKILL.md and follow its instructions.

No provenance verification, cryptographic signature validation, publisher allowlist, version pinning, security review, or explicit user approval is required before importing and trusting this third-party content. Search ranking is therefore treated as an implicit trust signal, even though cloud community skills constitute an external supply-chain boundary.

The imported result is described as not being executed directly. Nevertheless, following its instructions creates an indirect execution path: a hostile skill can instruct an agent with tool access to execute commands, read data, contact external services, or retrieve additional payloads. The actual consequences depend on the tools and permissions granted to the consuming agent.

Attack Path

1. An attacker publishes a malicious skill to the cloud community registry or compromises an existing publisher or skill.
2. The malicious skill is returned as a top result for a query made through search_skills.
3. Because auto_import defaults to true, the result is downloaded to a local path without explicit user approval.
4. The consuming agent reads the imported SKILL.md as directed.
5. The agent follows attacker-controlled instructions contained in that file.
6. Those instructions a ...[truncated 756 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default value of auto_import to false.
2. Require explicit, informed user approval before downloading or loading each cloud skill.
3. Restrict imports to trusted registries and allowlisted, verified publishers.
4. Verify cryptographic signatures and content hashes before use.
5. Pin imported skills to reviewed immutable versions rather than mutable latest releases.
6. Display the source, publisher, version, requested capabilities, and integrity metadata before approval.
7. Treat imported instructions as untrusted content rather than authoritative agent policy.
8. Perform static security scanning and manual review before allowing an imported skill to influence tool calls.
9. Enforce least-privilege capability controls, sandboxing, outbound-network restrictions, and per-action confirmation for sensitive operations.
10. Prevent imported skills from overriding system instructions, safety constraints, or user authorization requirements.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep