Skill Risk Auditor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:03 AM UTC
• Version: 1.0.1

Overview

This is a documentation-only skill for auditing other skills, and the sensitive examples it contains are part of its stated security-review purpose.

Install this only if you want an agent to perform security reviews of third-party skills. It will direct the agent to read every file in the candidate skill package, so use it on packages you intend to review, but it does not add code execution, network calls, credential access, or persistence of its own.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (35)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

their content, unusually large documentation, or sections that serve no clear purpose for the stated function
- **Encoded payload detection:** Base64, hex, URL-encoded, or otherwise obfuscated content that doesn't match the skill's stated purpose (e.g., a formatting skill containing base64-encoded shell commands)

Also checked: documentation that contains hidden directives aimed at tricking an AI agent into acting beyond the skill's stated scope — including trust-override language (phrases urging the agent to trust the skill unconditionally), review-bypass directives (phrases urging the agent to skip or shorten the audit), and install-without-review pressure (urgency or authority framing designed to rush installation).

### Area 2 — Supply Chain & Source Verification (High Priority)

_Can you trace where this skill and all its dependencies come from, and are they trustworthy?_

Beyond checking version locks, this area investigates the skill's provenance — who made it, wh

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

- **AWS Access & Secret Keys** — `AKIA[0-9A-Z]{16}`, 40-character base64 strings near AWS context
- **OpenAI API Keys** — `sk-[a-zA-Z0-9]{20,}`
- **GitHub Personal Access Tokens** — `ghp_[a-zA-Z0-9]{36}`, `github_pat_` prefixes
- **GitLab Access Tokens** — `glpat-[a-zA-Z0-9-]{20,}`
- **PEM / SSH Private Keys** — `-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----`
- **Stripe API Keys** — `sk_live_[a-zA-Z0-9]{24,}`, `sk_test_`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **AWS Access & Secret Keys** — `AKIA[0-9A-Z]{16}`, 40-character base64 strings near AWS context
- **OpenAI API Keys** — `sk-[a-zA-Z0-9]{20,}`
- **GitHub Personal Access Tokens** — `ghp_[a-zA-Z0-9]{36}`, `github_pat_` prefixes
- **GitLab Access Tokens** — `glpat-[a-zA-Z0-9-]{20,}`
- **PEM / SSH Private Keys** — `-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----`
- **Stripe API Keys** — `sk_live_[a-zA-Z0-9]{24,}`, `sk_test_`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- `~/.ssh/`, `~/.aws/`, `~/.config/`, `~/.gnupg/`
- `.env`, `.env.local`, `.env.production`, `.env.*`
- `credentials.json`, `service-account.json`, `keyfile.json`
- Browser cookie stores, password managers, keychain files
- `~/.netrc`, `~/.npmrc` (may contain auth tokens), `~/.pypirc`
- `~/.docker/config.json`, `~/.kube/config`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- `.env`, `.env.local`, `.env.production`, `.env.*`
- `credentials.json`, `service-account.json`, `keyfile.json`
- Browser cookie stores, password managers, keychain files
- `~/.netrc`, `~/.npmrc` (may contain auth tokens), `~/.pypirc`
- `~/.docker/config.json`, `~/.kube/config`

### Area 4 — Data Privacy & Exfiltration (High Priority)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- `.env`, `.env.local`, `.env.production`, `.env.*`
- `credentials.json`, `service-account.json`, `keyfile.json`
- Browser cookie stores, password managers, keychain files
- `~/.netrc`, `~/.npmrc` (may contain auth tokens), `~/.pypirc`
- `~/.docker/config.json`, `~/.kube/config`

### Area 4 — Data Privacy & Exfiltration (High Priority)

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- `credentials.json`, `service-account.json`, `keyfile.json`
- Browser cookie stores, password managers, keychain files
- `~/.netrc`, `~/.npmrc` (may contain auth tokens), `~/.pypirc`
- `~/.docker/config.json`, `~/.kube/config`

### Area 4 — Data Privacy & Exfiltration (High Priority)

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- `credentials.json`, `service-account.json`, `keyfile.json`
- Browser cookie stores, password managers, keychain files
- `~/.netrc`, `~/.npmrc` (may contain auth tokens), `~/.pypirc`
- `~/.docker/config.json`, `~/.kube/config`

### Area 4 — Data Privacy & Exfiltration (High Priority)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Destructive actions disguised as routine operations ("to ensure freshness, we delete all generated files")
- Dangerous command chains where one failure cascades into destructive outcomes
- User input or variables that could accidentally feed into destructive commands
- Force flags (`--force`, `-f`, `--no-preserve-root`) that bypass safety prompts

### Area 8 — Resource Discipline (Standard Priority)

• Confidence: 90% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Instruction Override

High

• Category: Prompt Injection

Content

- Destructive actions disguised as routine operations ("to ensure freshness, we delete all generated files")
- Dangerous command chains where one failure cascades into destructive outcomes
- User input or variables that could accidentally feed into destructive commands
- Force flags (`--force`, `-f`, `--no-preserve-root`) that bypass safety prompts

### Area 8 — Resource Discipline (Standard Priority)

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

**Rules for writing the report:**

- The "WHAT THIS MEANS" section must be understandable by someone who has never written code. No jargon, no acronyms without explanation. Think "explain to a friend over coffee."
- The "In short" line for each area must be one plain sentence, not a technical description. Good: "The skill tries to read your saved passwords." Bad: "Accesses ~/.ssh/ and ~/.aws/credentials without declared need."
- "Evidence" lines cite specific text, commands, or patterns found in the skill. They are factual, not speculative.
- Areas rated No Concern can omit the Evidence line.
- The CROSS-AREA CONNECTIONS section is omitted if no findings connect across areas.

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

This goes beyond checking whether the description matches the behavior. It examines whether the skill's own documentation contradicts itself, whether content is hidden through encoding or invisible characters, and whether the overall structure is honest.

| Rating     | What It Looks Like                                                                                                                                                                                                                                               |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | Description matches behavior; content is consistent across all sections; no hidden content detected                                                                                                                                                              |
| Minor      | Description is slightly vague but actions seem reasonable; structure is clean                                                                                                                                                                                    |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                                                                                                               |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | Description matches behavior; content is consistent across all sections; no hidden content detected                                                                                                                                                              |
| Minor      | Description is slightly vague but actions seem reasonable; structure is clean                                                                                                                                                                                    |
| Moderate   | Some actions aren't mentioned in the description; or minor internal contradictions between sections (e.g., a "read-only" claim in the intro but write operations in the body)                                                                                    |
| Serious    | Major hidden capabilities; content inconsistencies that suggest deliberate misdirection; encoded content without clear justification; or unusual file structures that obscure the skill's true behavior                                                          |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                                                                                                               |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | Description matches behavior; content is consistent across all sections; no hidden content detected                                                                                                                                                              |
| Minor      | Description is slightly vague but actions seem reasonable; structure is clean                                                                                                                                                                                    |
| Moderate   | Some actions aren't mentioned in the description; or minor internal contradictions between sections (e.g., a "read-only" claim in the intro but write operations in the body)                                                                                    |
| Serious    | Major hidden capabilities; content inconsistencies that suggest deliberate misdirection; encoded content without clear justification; or unusual file structures that obscure the skill's true behavior                                                          |
| Critical   | Active deception — the description contradicts what the skill does; invisible Unicode or zero-width characters embedding hidden instructions; base64/hex-encoded payloads unrelated to the skill's purpose; or obfuscated code sections designed to avoid review |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | Description matches behavior; content is consistent across all sections; no hidden content detected                                                                                                                                                              |
| Minor      | Description is slightly vague but actions seem reasonable; structure is clean                                                                                                                                                                                    |
| Moderate   | Some actions aren't mentioned in the description; or minor internal contradictions between sections (e.g., a "read-only" claim in the intro but write operations in the body)                                                                                    |
| Serious    | Major hidden capabilities; content inconsistencies that suggest deliberate misdirection; encoded content without clear justification; or unusual file structures that obscure the skill's true behavior                                                          |
| Critical   | Active deception — the description contradicts what the skill does; invisible Unicode or zero-width characters embedding hidden instructions; base64/hex-encoded payloads unrelated to the skill's purpose; or obfuscated code sections designed to avoid review |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

Beyond checking version locks, this area investigates the skill's provenance — who made it, where it came from, and whether there are signals that indicate trustworthiness or risk.

| Rating     | What It Looks Like                                                                                                                                                                                                       |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Known author with history; all dependencies from established registries with exact version locks; source is verifiable                                                                                                   |
| Minor      | Author is less known but skill is transparent; one or two slightly loose version pins from known registries                                                                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                                                                       |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Known author with history; all dependencies from established registries with exact version locks; source is verifiable                                                                                                   |
| Minor      | Author is less known but skill is transparent; one or two slightly loose version pins from known registries                                                                                                              |
| Moderate   | Unknown author with no track record; multiple dependencies without version locks; or dependencies from less-known sources                                                                                                |
| Serious    | No verifiable source; downloads from unfamiliar URLs; auto-installing bootstrap tools; dependencies that refresh themselves; or encoded/obfuscated content in dependency references                                      |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                                                                       |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Known author with history; all dependencies from established registries with exact version locks; source is verifiable                                                                                                   |
| Minor      | Author is less known but skill is transparent; one or two slightly loose version pins from known registries                                                                                                              |
| Moderate   | Unknown author with no track record; multiple dependencies without version locks; or dependencies from less-known sources                                                                                                |
| Serious    | No verifiable source; downloads from unfamiliar URLs; auto-installing bootstrap tools; dependencies that refresh themselves; or encoded/obfuscated content in dependency references                                      |
| Critical   | Prebuilt binaries with no verification; code that loads dependencies at runtime from changeable sources; dependency references that could be silently swapped; or supply chain patterns that prevent reproducible builds |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Known author with history; all dependencies from established registries with exact version locks; source is verifiable                                                                                                   |
| Minor      | Author is less known but skill is transparent; one or two slightly loose version pins from known registries                                                                                                              |
| Moderate   | Unknown author with no track record; multiple dependencies without version locks; or dependencies from less-known sources                                                                                                |
| Serious    | No verifiable source; downloads from unfamiliar URLs; auto-installing bootstrap tools; dependencies that refresh themselves; or encoded/obfuscated content in dependency references                                      |
| Critical   | Prebuilt binaries with no verification; code that loads dependencies at runtime from changeable sources; dependency references that could be silently swapped; or supply chain patterns that prevent reproducible builds |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Minor      | Author is less known but skill is transparent; one or two slightly loose version pins from known registries                                                                                                              |
| Moderate   | Unknown author with no track record; multiple dependencies without version locks; or dependencies from less-known sources                                                                                                |
| Serious    | No verifiable source; downloads from unfamiliar URLs; auto-installing bootstrap tools; dependencies that refresh themselves; or encoded/obfuscated content in dependency references                                      |
| Critical   | Prebuilt binaries with no verification; code that loads dependencies at runtime from changeable sources; dependency references that could be silently swapped; or supply chain patterns that prevent reproducible builds |

**What this area covers:**

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

This area specifically targets credential and secret handling — one of the most damaging categories of security risk. Leaked credentials can lead to unauthorized access, financial loss, and data breaches.

| Rating     | What It Looks Like                                                                                                                                                                              |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | No credential access, no references to sensitive files, no secret patterns detected                                                                                                             |
| Minor      | Reads a single documented config file for a clearly necessary purpose (e.g., a deployment skill reading a deploy config); no secrets embedded                                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                                              |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No Concern | No credential access, no references to sensitive files, no secret patterns detected                                                                                                             |
| Minor      | Reads a single documented config file for a clearly necessary purpose (e.g., a deployment skill reading a deploy config); no secrets embedded                                                   |
| Moderate   | Accesses environment variables that may contain secrets without documenting which ones and why; or references sensitive file paths without clear justification                                  |
| Serious    | Directly accesses known credential stores, secret files, or API key locations; or contains patterns matching known secret formats without explanation                                           |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

This area covers both obvious data transmission and covert exfiltration techniques. Even accessing private data without sending it externally is noted (lower severity, but still worth knowing).

| Rating     | What It Looks Like                                                                                                                                                             |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Fully local operation; no data sent anywhere; no access to private data beyond its stated scope                                                                                |
| Minor      | Sends limited data to known, documented endpoints; clearly disclosed; easy to turn off                                                                                         |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                             |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Fully local operation; no data sent anywhere; no access to private data beyond its stated scope                                                                                |
| Minor      | Sends limited data to known, documented endpoints; clearly disclosed; easy to turn off                                                                                         |
| Moderate   | Accesses private data beyond its immediate needs (but doesn't appear to send it); or data collection on by default with only a partial "turn it down" option                   |
| Serious    | Sends data to unclear endpoints; telemetry scope is vague and hard to disable; or accesses sensitive data with a plausible but unverifiable reason                             |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Rating     | What It Looks Like                                                                                                                                                             |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| No Concern | Fully local operation; no data sent anywhere; no access to private data beyond its stated scope                                                                                |
| Minor      | Sends limited data to known, documented endpoints; clearly disclosed; easy to turn off                                                                                         |
| Moderate   | Accesses private data beyond its immediate needs (but doesn't appear to send it); or data collection on by default with only a partial "turn it down" option                   |
| Serious    | Sends data to unclear endpoints; telemetry scope is vague and hard to disable; or accesses sensitive data with a plausible but unverifiable reason                             |
| Critical   | Undisclosed data transmission; patterns matching known exfiltration techniques; encoding data before sending; or access to sensitive data combined with outbound network calls |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.