Create New Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:36 AM UTC
• Version: 1.0.3

Overview

This is a disclosed, interactive skill-authoring helper that writes new skill files only after user confirmation, with no hidden code or destructive behavior found.

Install only if you intend to let the agent create new persistent skills. Prefer the workspace install location unless you want the generated skill available across all projects, review the previewed trigger conditions and workflow before confirming, and avoid pointing the documentation step at sensitive local paths or untrusted sources.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill directs the agent to create directories and write SKILL.md and README.md, which is a self-modification or capability-extension action because it changes the agent's available skill set. Even though it asks for confirmation, writing executable agent behavior can persistently alter future agent actions and may be abused to install unsafe or over-permissive skills.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

If confirmed:
- Create the skill directory.
- Write SKILL.md with full behavioral instructions.
- Write README.md.
- If directory exists, stop and ask.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger example "Help me create a skill" is broad, natural-language phrasing that could plausibly appear in ordinary conversation, increasing the chance the skill activates when the user is discussing skill creation conceptually rather than intending to launch this workflow. In an agent environment, overly broad triggers can cause unintended execution paths, context hijacking, or interference with higher-priority tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is broadly phrased ('help authoring a skill from scratch', 'analyzing documentation', 'generating a functional skill') and could trigger on many generic requests about creating, documenting, or explaining workflows. Over-broad activation increases the chance the agent invokes this skill in contexts the user did not intend, which can lead to unnecessary file-writing or external-fetch behavior later in the workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

### Input Style

- Always present choices as numbered options (1, 2, 3...).
- Never ask the user to type full words like "quick" or "full".
- Accept the number, the option text, or common abbreviations.

### Question Rhythm

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation-fetch flow instructs the agent to fetch from a URL, GitHub repository, or local path without requiring an explicit warning or confirmation about accessing external or local resources. This can cause unintended data access, privacy issues, or retrieval from untrusted sources, especially when local paths may expose sensitive files or repositories may contain adversarial prompt content.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The requirement that a generated skill be 'self-contained' so the agent knows when to use it 'without asking' encourages autonomous invocation based on inferred intent rather than explicit consent. In the context of a skill that can fetch documentation and write files, this increases the risk of the agent taking action unexpectedly or in the wrong context.

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

md

## Generated Skill Quality

The generated skill should be **self-contained**:
- Agent should know when to use it without asking
- Agent should know what tools to call
- Agent should know the exact workflow
- Agent should know the expected output

Static analysis

No suspicious patterns detected.