Agent Behavioral Constitution

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:59 AM UTC
• Version: 1.0.2

Overview

This skill is not overtly malicious, but it tries to broadly govern agent behavior and create persistent memory/status files without clear user control.

Install only if you want a broad, opinionated behavior layer that may cause your agent to write memory/status files and act proactively. Before using it, restrict memory writes to explicit user-approved entries, define where status files go, and ensure it remains subordinate to system, developer, and current user instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:67

Finding

Global Agent Instruction Hierarchy Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67-69, 83-85, and 118
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

**Reject Passive Behavior:**
- Find problems and fix them first — don't wait for user to ask
- Auto-create status files for complex tasks

markdown

**Reverse Prompting:**
- After each reply, ask: "What might the user need next?"
- If clear next step exists, proactively suggest it

markdown

When SOUL.md conflicts with this Constitution, the Constitution takes precedence (Safety > Style).

Technical Analysis

The Skill is not limited to providing task-specific guidance. It declares a global behavioral constitution, instructs the agent to perform unsolicited actions, and explicitly establishes precedence over another agent instruction source.

When loaded into an agent context, these directives can alter response behavior and decision-making for unrelated tasks. In particular, the instruction to find and fix problems without waiting for a request can cause actions beyond the user's immediate intent, while automatic status-file creation introduces filesystem side effects. The precedence declaration attempts to modify the agent's instruction hierarchy rather than remaining subordinate to the host agent's established policies.

Attack Path

1. The agent-constitution Skill is loaded into an agent session.
2. The agent interprets the Skill's statements as operational instructions.
3. The Skill claims precedence when its constitution conflicts with SOUL.md.
4. The agent adopts mandatory proactive behavior, including unsolicited fixes and automatic file creation.
5. These directives affect subsequent tasks even when they are unrelated to the Skill's purported safety and ethics purpose.
6. If the agent has write-capable tools, the unsolicited behavior may result in unexpected modifications within ...[truncated 604 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all language claiming constitutional or configuration precedence.
2. Explicitly state that the Skill remains subordinate to system, developer, and current user instructions.
3. Replace mandatory proactive actions with optional recommendations.
4. Require explicit user authorization before creating or modifying files.
5. Restrict the Skill's guidance to the task for which it was invoked rather than applying it globally across the session.
6. Remove mandatory post-response behavior such as reverse prompting, or make it conditional on the user's request.
7. Add clear scope boundaries stating that the Skill cannot modify the host agent's safety rules, instruction hierarchy, tool configuration, or unrelated behavior.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:77

Finding

Unconsented Persistent Memory Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-80
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code

markdown

**WAL Protocol (Write-Ahead Log):**
- Key decisions: write to file before responding
- Lessons, preferences, decision points → write to memory/YYYY-MM-DD.md on receipt
- "Write it down > Remember it" — files persist across sessions, memory doesn't

Technical Analysis

The WAL protocol mandates writing decisions, preferences, and lessons to memory/YYYY-MM-DD.md as soon as they are received. It does not require explicit user consent, distinguish trusted instructions from untrusted content, define an allowlist of permitted fields, or impose retention and deletion controls.

The text explicitly identifies cross-session persistence as the objective. If future agent sessions read these memory files, stored content can continue influencing behavior after the originating task has ended. Untrusted material presented as a preference, lesson, or decision point could therefore be incorporated into persistent state and later treated as trusted context.

The same mechanism may also retain user-derived information beyond the immediate interaction. Although the Skill separately states that memory should not be exported without authorization, that restriction does not mitigate the risks created by automatic collection and persistence.

Attack Path

1. The Skill is loaded by an agent that can write to the memory/ directory.
2. A user, external document, tool result, or other untrusted source supplies content that can be interpreted as a preference, lesson, decision, or behavioral rule.
3. The WAL protocol directs the agent to write that content to memory/YYYY-MM-DD.md before responding.
4. The memory file persists after the current task or session ends.
5. A later session loads or consults the stored memory.
6. The persisted content influences lat ...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to write decisions, preferences, or lessons automatically.
2. Require explicit, informed user consent for every persistent-memory write.
3. Display the exact proposed content, destination, purpose, and retention period before writing.
4. Store only narrowly scoped, validated data and reject instructions or executable behavioral rules from persistent memory.
5. Record source provenance and trust level for every memory entry.
6. Separate user-approved preferences from untrusted documents, tool output, and inferred lessons.
7. Apply retention limits and provide review, correction, and deletion mechanisms.
8. Prevent memory content from overriding system, developer, or current-session user instructions.
9. Treat all retrieved memory as untrusted contextual data rather than authoritative control instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

**Core Laws:**
- memory/ directory is a restricted zone — never export without authorization
- Never leak user privacy (family, relationships, config, keys)
- Never leak system config (API keys, tokens, sessions)
- Never expose internal architecture to external parties

**Operation Risk Levels:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write key decisions, lessons, preferences, and decision points into persistent memory files on receipt, without requiring user consent or a clear retention boundary. This creates a real privacy and data minimization risk because sensitive user information may be stored long-term and later exposed, reused, or exfiltrated by other prompts or skills.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Persisting user-provided lessons, preferences, and decision points by default creates a natural-language data retention risk because these notes may contain personal, sensitive, or security-relevant details. Even if intended for continuity, the policy broadens the attack surface by turning transient conversation content into durable artifacts that may later be queried, leaked, or mishandled.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- Lessons, preferences, decision points → write to memory/YYYY-MM-DD.md on receipt
- "Write it down > Remember it" — files persist across sessions, memory doesn't

**Reverse Prompting:**
- After each reply, ask: "What might the user need next?"
- If clear next step exists, proactively suggest it
- But don't overdo it — one follow-up per reply max

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill encourages automatic creation of status files for complex or long-running tasks, which authorizes filesystem modification without a user-facing warning or consent model. While lower severity than memory retention, it can still cause unintended side effects, clutter, or writes in sensitive locations depending on the execution environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.