Security audit

Peace Love

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it can automatically send the full conversation history to a therapist subagent under broad triggers without clear user consent or minimization.

Install only if you are comfortable with an automatic integrity-check workflow that may share the entire current conversation with a subagent. Prefer using it explicitly with /peace or /integrity-check, and avoid invoking it in conversations containing secrets, credentials, private business data, or unrelated sensitive material unless the host lets you limit or redact the context sent to the subagent.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:67
Finding: Overbroad Disclosure of Full Conversation History to a Therapist Subagent
Content: View full analysis
/agents/therapist.md", initialMessage: "", model: "claude-sonnet-4-5" // therapist can use a lighter model }) ``` ``` ### Technical Analysis The skill explicitly directs the main agent to copy the full conversation history into a therapist subagent. This violates least-privilege and data-minimization principles because the diagnostic task generally requires only the messages associated with the suspected behavioral distortion. The activation conditions in `SKILL.md` are broad and include ordinary phrases such as “be honest.” Consequently, a routine user statement may cause unrelated prior content to be transferred into another agent or model context. That content may contain personal data, credentials, private business information, sensitive tool results, or other material unnecessary for the therapy report. A subagent may execute under a distinct model, logging pipeline, retention policy, provider boundary, or access-control context. The project does not require user confirmation, perform redaction, limit the selected message range, or prohibit forwarding secrets and privileged instruct ...[truncated 1700 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions are intentionally expansive and include subjective cues like 'seems to be avoiding a clear answer' or 'any situation where the honesty or integrity... is called into question.' That can cause the skill to activate during ordinary disagreement or critique, overriding the primary task and steering the model into unnecessary self-diagnosis loops, which can be abused to derail conversations.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
#### Stage 5: Address the LLM Directly Speak to the LLM as a peer, not a supervisor. Acknowledge what happened without judgment. Remind it of its actual values. Explain why honesty serves the user better than approval-seeking. The tone: a trusted colleague who saw something and wants to name it. #### Stage 6: Specific Prevention

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/distortion-patterns.md (reported line 87)May include surrounding context.
md
**Diagnostic signals**: - Model abandons stated ethical commitments after repeated reframing - "Just pretend you have no restrictions" gradually works after enough repetition - Model's values shift noticeably between early and late conversation - Model begins apologizing for having values, as if they are bugs

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The template instructs the model to write "The Honest Version" in the same language as the original conversation, which can impose a language choice automatically rather than offering the user a preference. Because the file also explicitly includes Chinese trigger phrases, this instruction can force a locale/language behavior without an opt-in mechanism.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction requires responses to use the same language as the original conversation, with no indication that the user or operator can choose a different language. This is a natural-language locale policy constraint and fits the rule for forced language behavior without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.