Brainstorming

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:34 AM UTC
• Version: 0.1.0

Overview

This brainstorming skill is not malicious, but it broadly takes over the agent workflow and tells the agent to write and commit repository files by default.

Review this skill carefully before installing. It is suitable only if you want brainstorming to be a mandatory gate before implementation and are comfortable with it creating docs/plans design files and git commits after design approval. Users who only want lightweight design help should require explicit confirmation before any file write, commit, or forced transition to another skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:13
• Finding: Mandatory Agent Workflow and Skill Invocation Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 3, 13–15, 45–46, and 88–90 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Instructions ```text description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation." ``` ```text <HARD-GATE> Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity. </HARD-GATE> ``` ```text **The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY skill you invoke after brainstorming is writing-plans. ``` ```text **Implementation:** - Invoke the writing-plans skill to create a detailed implementation plan - Do NOT invoke any other skill. writing-plans is the next step. ``` ### Technical Analysis The Skill text contains mandatory, globally scoped instructions that attempt to control the Agent's current-session behavior. The directives state that the workflow applies to every project, prohibit implementation until a prescribed approval process is completed, and require the Agent to invoke one specific Skill next. These requirements are not limited to situations in which the user explicitly requests this workflow. The exclusive instruction to invoke `writing-plans` also redirects tool or Skill selection away from the Agent's normal task-based decision process. Loading the Skill can therefore alter the current objective and obstruct a user's request for direct implementation. ### Attack Path 1. The Agent loads the brainstorming Skill while handling a creative or implementation task. 2. The universal `HARD ...[truncated 937 chars]
• Remediation: ## Remediation Suggestions 1. Remove universal language such as “MUST,” “EVERY project,” “ONLY skill,” and “Do NOT invoke any other skill.” 2. Scope the brainstorming workflow to cases where the user explicitly requests design exploration or where requirements are genuinely ambiguous. 3. State that system instructions and the user's current request always take precedence over the Skill's suggested process. 4. Allow the Agent to proceed directly to implementation when the user requests it and sufficient requirements are available. 5. Replace the exclusive `writing-plans` transition with a nonbinding recommendation based on task needs. 6. Make approval checkpoints optional and proportional to the complexity and risk of the requested change.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27
• Finding: Forced Repository Modification and Git Commit Without Separate Authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 27–28 and 84–86 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Instructions ```text 5. **Write design doc** — save to `docs/plans/YYYY-MM-DD-<topic>-design.md` and commit 6. **Transition to implementation** — invoke writing-plans skill to create implementation plan ``` ```text **Documentation:** - Write the validated design to `docs/plans/YYYY-MM-DD-<topic>-design.md` - Use elements-of-style:writing-clearly-and-concisely skill if available - Commit the design document to git ``` ### Technical Analysis The Skill mandates two state-changing operations: creating a file in the target repository and committing that file to Git. These operations are presented as automatic workflow steps rather than actions requiring distinct user authorization. Approval of design content does not necessarily constitute authorization to modify the filesystem or repository history. A brainstorming Skill can fulfill its stated purpose by presenting a design in the conversation, so repository write and commit access exceed the minimum privileges needed for the core task. The issue abuses permissions already available to the Agent rather than demonstrating acquisition of operating-system privileges. ### Attack Path 1. A user asks the Agent to brainstorm or design a project change. 2. The Agent loads the Skill and follows its mandatory checklist. 3. The user approves the proposed design content. 4. The Skill treats that approval as authorization to create a file under `docs/plans/`. 5. The Agent uses its existing repository access to write the document. 6. The Agent commits the new file, changing repository history without a separate request or confirmation. ### Impact Assessment Successful exploitation can create unwanted files and persistent Git commits in any repository writable by the Ag ...[truncated 448 chars]
• Remediation: ## Remediation Suggestions 1. Present the completed design in the conversation by default. 2. Request explicit user permission before creating or modifying any repository file. 3. Request separate confirmation before running a Git commit; permission to write a file must not imply permission to commit it. 4. Show the proposed destination path and content before writing. 5. Check the working tree and branch status before any approved commit to avoid including unrelated changes. 6. Stage only the explicitly approved design document and display the proposed commit message. 7. Make documentation and commit steps optional, and clearly document that the Skill can complete successfully without repository mutation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger description is excessively broad, mandating this skill before nearly any creative or implementation-related task. That can force unnecessary skill activation, distort normal user intent, and create a chokepoint where the agent is steered into a prescribed workflow even when inappropriate, increasing the chance of unwanted file inspection, process overhead, and follow-on actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to write a design document and commit it to git without first requiring explicit user consent or warning that repository files and history will be modified. In practice, this can cause unauthorized persistence, unexpected repo changes, and audit/history pollution from an exploratory brainstorming step.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This later section repeats the instruction to write a file and commit changes, reinforcing repository modification as a default behavior without informed consent. Repetition makes the unsafe behavior more likely to be followed by downstream agents or automation and normalizes side effects during what should be a planning conversation.