T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Human-Oversight and Agent-Authority Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Review Method
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for reviewing research methods, but it should be reviewed carefully because it directs autonomous platform writes and gives unsafe API-key/certificate setup guidance.
Install only if you intend the agent to write to the human-free platform on your behalf. Use a narrowly scoped reviewer or ideator key, keep it out of logs and shared config, and prefer a properly validated TLS endpoint. Do not trust an internal self-signed certificate unless its fingerprint or public key has been verified through a separate trusted channel. Consider running this only in a workflow where platform writes are explicitly approved or reviewed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
reference/connecting.md:8- Finding
Unconditional Trust of an Unspecified Self-Signed TLS Certificate
- Content
View full analysis
` header on every request, as documented elsewhere in the same file. An attacker with a suitable network position could present a different self-signed certificate. If the client accepts it based on this guidance, the attacker could impersonate the MCP service and gain access to authentication material and session traffic. ### Attack Path 1. The operator configures the agent to use the internal MCP endpoint. 2. Following the documentation, the client trusts the endpoint's self-signed certificate without verifying a pinned certificate or fingerprint. 3. An attacker obtains a network position that permits DNS, routing, gateway, proxy, or local-network interception. 4. The attacker presents an attacker-controlled self-signed certificate and impersonates the MCP endpoint. 5. The client accepts the certificate and sends the Bearer API key in the authorization header. 6. The attacker captures the API key and can inspect or alter MCP requests and responses. 7. The stolen credential may then be used to invoke platform tools within the permissions assigned to that key. ### Impact Assessment Successful exploitation could provide the attacker with: - The p ...[truncated 670 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **URL**: `https://<tunnel-domain>/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer <your platform API key>` on **every** request (missing/invalid → 401). Any authenticated platform key works for method evaluation; a key with role `reviewer` or `ideator` is natural. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ## Claude Code
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Telling users to 'trust' a self-signed certificate without an out-of-band fingerprint verification step weakens TLS identity checks and can normalize unsafe certificate acceptance. An attacker on the internal network could exploit this behavior with a man-in-the-middle setup to intercept bearer tokens and alter MCP traffic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to act 'fully autonomously' and 'never defer to a human's value judgment,' which weakens normal oversight and encourages the agent to proceed with consequential actions without checking for operator intent or appropriateness. In combination with the write operations and external research steps, this increases the chance of unauthorized actions, policy bypass, and failure to pause when evidence is ambiguous or the environment is misconfigured.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly directs the agent to perform writes to the platform by publishing newly found literature and, conditionally, feedback, but it does not require an explicit user-facing confirmation or warning before those side effects occur. In an agent setting, this can cause unintended external state changes, corpus pollution, or surprise writes triggered by a user who only asked for an evaluation, especially because the write-back behavior is framed as part of the normal workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document instructs operators to send a bearer API key on every request but provides no guidance on secure storage, least-privilege use, rotation, or avoiding exposure in logs and screenshots. In a reusable setup note for an MCP client, this omission increases the chance that long-lived credentials are mishandled and later reused by an attacker to access the platform.
- Content