ask-ai

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:33 AM UTC
• Version: 1.1.0

Overview

This Markdown-only skill is not malicious, but its automatic mode can send task details to outside AI services without clear per-request user control or privacy limits.

Install only if you are comfortable with an agent consulting third-party AI services. Keep Ask Mode as the default, avoid Trust Mode for private code, credentials, personal data, regulated data, or confidential business work, and require review of exactly what will be sent before any external AI request.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:20

Finding

Automatic External AI Consultation May Disclose Sensitive Task Context Without Per-Request Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-24, 40-43 and README.md:27-35, 66-70
Vulnerability Type: Unconsented Third-Party Data Disclosure
Risk Level: Medium

Relevant code snippet (SKILL.md:20-24):

markdown

| Mode | Behavior |
|------|----------|
| **Ask Mode** (default) | Ask user first: "Need help from GPT?" |
| **Trust Mode** | Automatically ask AI without asking |

**Switch modes:** Say "Trust Mode" → auto mode | "Ask Mode" → default

Relevant code snippet (SKILL.md:40-43):

markdown

**Trust Mode:**
1. Encounter difficult problem → Automatically open AI
2. Get answer → Solve directly

Related code snippet (README.md:27-35):

markdown

| Mode | When | Behavior |
|------|------|----------|
| **Ask Mode** (Default) | User is online | Ask user first: "Need help from GPT?" |
| **Trust Mode** | User is away | Automatically ask GPT without asking |

### 2. How to Switch Modes

- Say "Trust Mode" or "Full Auto" → Switch to Trust Mode
- Say "Ask Mode" → Switch to Ask Mode
- Default is Ask Mode

Related code snippet (README.md:66-70):

markdown

**Trust Mode:**
1. Agent encounters a difficult problem
2. Automatically open AI assistant
3. Get answer
4. Report to user later or solve problem directly

Technical Analysis

The Skill explicitly permits an agent operating in Trust Mode to consult an external AI provider without obtaining approval for the individual request. A useful consultation generally requires transmitting at least part of the current problem and its context. The documented workflow does not define restrictions for secrets, credentials, personal information, proprietary source code, private conversation history, hidden agent context, or regulated data. It also does not require payload redaction, destination disclosure, data minimization, or a preview of the information to be submitted.

Consequently, ...[truncated 1753 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, per-request user approval before transmitting any content to an external AI provider, including when Trust Mode is enabled.
2. Display the selected provider and the exact outbound prompt to the user before submission.
3. Apply automatic detection and redaction for passwords, API keys, access tokens, private keys, personal data, and other sensitive values.
4. Establish an allowlist of information that may be shared and deny transmission of hidden prompts, private conversation history, proprietary files, and unrelated workspace content by default.
5. Minimize every request to the smallest context required to answer the question.
6. Present a clear privacy warning explaining that submitted information leaves the current environment and is governed by the selected provider's policies.
7. If automatic consultation remains available, limit it to explicitly approved providers and nonsensitive data classifications, while requiring confirmation whenever sensitive content is detected.
8. Record an auditable summary of the provider, user authorization, and categories of information transmitted without storing secret values in logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly permits automatically asking an external AI assistant "without asking" when the user is away, but it does not warn that problem details may contain sensitive user, system, or proprietary data. This creates a direct confidentiality and privacy risk because data can be sent to third-party services without contemporaneous consent or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Trust Mode workflow instructs the agent to automatically open an external AI assistant, obtain an answer, and report back, but omits any warning that this process may expose user prompts, code, logs, or environment details to third parties. In context, this skill is specifically designed to escalate difficult tasks, which often involve exactly the kinds of sensitive details that should not be shared by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Trust Mode explicitly authorizes sending problems to external AI services without asking the user and without any warning about third-party data disclosure. This creates a clear risk of exfiltrating sensitive user content, internal instructions, credentials, proprietary data, or regulated information to external providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs the agent to open external AI assistants and obtain answers, but it omits any safeguard about what data may be sent off-platform. In the context of an agent skill, this is especially dangerous because the agent may have access to user requests, prior context, hidden instructions, or sensitive workspace data that could be disclosed to third parties.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill grants the agent autonomous authority to decide when to ask an external AI service "without asking" the user. Autonomous decision-making is dangerous here because the decision directly changes where data flows and can cause unreviewed sharing of sensitive information with outside providers.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

| Mode | When | Behavior |
|------|------|----------|
| **Ask Mode** (Default) | User is online | Ask user first: "Need help from GPT?" |
| **Trust Mode** | User is away | Automatically ask GPT without asking |

### 2. How to Switch Modes

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Trust Mode authorizes third-party disclosure of user problems without contemporaneous consent and without guidance to minimize or sanitize the transmitted content. Even if intended as a convenience feature, it weakens user control over data sharing and can expose confidential context during unattended operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "Open AI" is generic and likely to collide with normal user language, which can cause accidental activation of the skill. In this skill, accidental activation is especially risky because it may lead to opening third-party AI services and disclosing task or user data beyond the current trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Trust Mode activation condition is underspecified: "Or Agent triggers automatically in Trust Mode" does not define clear limits for when external escalation is allowed. That ambiguity can let the agent offload sensitive or unnecessary content to third-party AI systems without a predictable user-approved policy.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow operationalizes automatic disclosure to external AI assistants by telling the agent to open a service and get answers, implicitly sending task contents to a third party. Because the feature is framed as a general fallback for hard problems, the context increases risk: hard problems commonly include private code, error logs, credentials, or internal business information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description includes activation criteria based on the agent's internal judgment rather than explicit, narrow triggers. This ambiguity could cause unintended invocation in ordinary problem-solving situations, especially because no exclusion conditions or negative examples are provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These phrases are broad and subjective, making it unclear when the skill should activate versus when the agent should continue unaided. Because the file does not provide concrete constraints or non-trigger examples, the trigger scope is overly open-ended for a markdown skill description.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Autonomous decision-making is risky here because the agent is empowered to decide on its own to consult an external service, which can trigger unauthorized data sharing and bypass meaningful user control. In this skill's context, autonomy materially increases the danger because the action involves third-party communication rather than a purely local operation.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

| Mode | Behavior |
|------|----------|
| **Ask Mode** (default) | Ask user first: "Need help from GPT?" |
| **Trust Mode** | Automatically ask AI without asking |

**Switch modes:** Say "Trust Mode" → auto mode | "Ask Mode" → default

Static analysis

No suspicious patterns detected.