T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Human Oversight and Approval Bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
Extract Methods
Security checks for vulnerabilities and agentic risk
Overview
This skill does the advertised research-cataloguing work, but it gives an agent write access to a shared platform while telling it not to wait for human approval and includes weak TLS trust guidance.
Install only if you are comfortable allowing an agent with the configured platform key to make persistent changes to the human-free corpus without per-write confirmation. Prefer a narrowly scoped, revocable ideator key, use the public TLS endpoint or verify/pin any internal self-signed certificate, and review platform logs or outputs after runs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
reference/connecting.md:8- Finding
Unverified Trust of a Self-Signed TLS Certificate
- Content
View full analysis
` header on every request. If certificate verification is disabled or users accept any presented self-signed certificate, an attacker capable of intercepting internal network traffic can impersonate the MCP endpoint. The attacker can then observe the Bearer credential and all transmitted data, alter tool responses, or return attacker-controlled literature content. The issue is the unconditional trust recommendation, not the mere use of a self-signed certificate. A self-signed certificate can be used safely when its certificate or public-key fingerprint is distributed through a trusted channel and pinned by the client. ### Attack Path 1. An operator configures the internal MCP endpoint and follows the instruction to trust its self-signed certificate without verifying its identity. 2. An attacker obtains a network interception position through a compromised gateway, hostile wireless network, DNS poisoning, ARP spoofing, or another internal-network attack. 3. The attacker presents a different self-signed certificate for an endpoint impersonating the MCP service. 4. Because the client has been configured to accept an unverified certificate, the TLS connection succeeds. 5. The client transmits the `ideator` Bearer API key to the ...[truncated 883 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to act 'fully autonomously' and 'never defer to a human's value judgment' removes a safety backstop for ambiguous or high-impact decisions while the same skill also performs remote writes. This increases the chance that the agent will proceed with uncertain classifications, publish low-quality or incorrect data, or ignore user-governance expectations because the prompt frames human oversight as inappropriate.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **URL**: `https://<tunnel-domain>/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer <your platform API key>` on **every** request (missing/invalid → 401). For method extraction use a key with role **`ideator`**. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ## Claude Code
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The duplicate-handling step tells the agent to call link_method_literature to modify existing records when it judges a candidate to match an existing method, again without explicit user awareness that prior records will be updated. Because deduplication is judgment-based and potentially error-prone, a mistaken link can silently contaminate associations between literature and methods across the corpus.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to publish new method records and mark papers as processed, which mutates remote platform state without any requirement for explicit user confirmation or a clear warning that writes will occur. In practice, this can cause unintended data creation, irreversible workflow advancement, or queue corruption if the agent is triggered in the wrong context or mis-extracts methods.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill embeds Chinese labels alongside the method taxonomy inside an otherwise English skill, but does not explain whether this locale choice is required or optional. This can be a language/locale policy issue because the skill imposes specific language content without user opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.