Writing Skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:19 PM UTC
• Version: 0.1.0

Overview

This is a skill-authoring guide that can change future agent behavior when used, but its file editing, testing guidance, and helper script are disclosed and aligned with that purpose.

Install only if you want an agent to help author or revise reusable skills. Review any created or edited skill diffs before enabling them, avoid applying the examples as blanket instructions to search all local skills on every task, and run the Graphviz helper only on skill directories you trust.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description is broad and generic, suggesting an all-purpose tool for creating, editing, or validating skills prior to deployment. The actual code has a much narrower and specific purpose: visualizing embedded Graphviz diagrams from SKILL.md by rendering them to SVG files. That is not an implementation detail of skill creation/editing/verification; it is a distinct utility with file-generation and external-process execution behavior that is not conveyed by the declared description. Therefore the description does not accurately represent the code's primary behavior.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This skill explicitly instructs the agent to write or modify skills, which is self-modification of agent behavior/policy-adjacent artifacts. In a system where skills influence future model behavior, documentation that normalizes creating and editing skills can be abused to introduce malicious instructions, weaken safeguards, or persist prompt-level backdoors if an untrusted user can trigger it.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

| **Refactor** | Close loopholes while maintaining compliance |
| **Write test first** | Run baseline scenario BEFORE writing skill |
| **Watch it fail** | Document exact rationalizations agent uses |
| **Minimal code** | Write skill addressing those specific violations |
| **Watch it pass** | Verify agent now complies |
| **Refactor cycle** | Find new rationalizations → plug → re-verify |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.

md

**Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

md

**Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md

**Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The text directly instructs writing skills before deployment workflows complete, reinforcing an agent capability to alter its own reusable instruction set. Even though the stated purpose is quality-focused, enabling autonomous edits to skill files increases the risk of persistence and policy drift if an attacker social-engineers the agent into changing these artifacts.

Content

Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Editing existing skills is more dangerous than authoring new isolated content because it can silently alter trusted behavior that other future sessions may load automatically. In context, this creates a persistence surface where malicious or negligent edits could broaden triggers, disable caution, or embed adversarial instructions into frequently used skills.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**
- Not for "simple additions"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This section operationalizes the self-modification workflow by telling the agent to write a minimal skill and validate it, which is effectively a process for changing future agent behavior. The danger is contextual: in a skill-authoring skill, such instructions are expected, but without authorization and safety boundaries they can be leveraged to create durable prompt injections or unsafe automation patterns.

Content

Scanner excerpt · SKILL.md (reported line 548)May include surrounding context.

md

### GREEN: Write Minimal Skill

Write skill that addresses those specific rationalizations. Don't add extra content for hypothetical cases.

Run same scenarios WITH skill. Agent should now comply.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The concluding guidance reinforces a generalized practice of writing skills, i.e., modifying reusable behavioral documentation. Because skills may be auto-discovered and loaded later, this creates a meaningful persistence and instruction-manipulation risk even though the text itself is not overtly malicious.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md

**Creating skills IS TDD for process documentation.**

Same Iron Law: No skill without failing test first.
Same cycle: RED (baseline) → GREEN (write skill) → REFACTOR (close loopholes).
Same benefits: Better quality, fewer surprises, bulletproof results.

If you follow TDD for code, follow it for skills. It's the same discipline applied to documentation.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · anthropic-best-practices.md (reported line 5)May include surrounding context.

md

> Learn how to write effective Skills that Claude can discover and use successfully.

Good Skills are concise, well-structured, and tested with real usage. This guide provides practical authoring decisions to help you write Skills that Claude can discover and use effectively.

For conceptual background on how Skills work, see the [Skills overview](/en/docs/agents-and-tools/agent-skills/overview).

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 85)May include surrounding context.

relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

### Variant C: Claude.AI Emphatic Style

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 95)May include surrounding context.

relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

### Variant C: Claude.AI Emphatic Style

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 123)May include surrounding context.

md

1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

2. **If skill exists:** Read it completely before proceeding

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 9)May include surrounding context.

md

**Testing skills is just TDD applied to process documentation.**

You run scenarios without the skill (RED - watch agent fail), write skill addressing those failures (GREEN - watch agent comply), then close loopholes (REFACTOR - stay compliant).

**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill prevents the right failures.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 36)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 84)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · testing-skills-with-subagents.md (reported line 364)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

On L003, the description says to use the skill when 'creating new skills, editing existing skills, or verifying skills work before deployment.' This spans nearly the entire skill authoring lifecycle and does not provide exclusions or tighter constraints, increasing the chance of unintended invocation for ordinary editing or verification work.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

**Writing skills IS Test-Driven Development applied to process documentation.**

**Personal skills live in agent-specific directories (`~/.claude/skills` for Claude Code, `~/.agents/skills/` for Codex)** 

You write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

Verification:

bash

wc -w skills/path/SKILL.md
# getting-started workflows: aim for <150 each
# Other frequently-loaded: aim for <200 total

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 73)May include surrounding context.

markdown

## Skills Library

You have access to skills at `~/.claude/skills/`. Consider
checking for relevant skills before working on tasks.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 84)May include surrounding context.

Before working on any task, check ~/.claude/skills/ for relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 94)May include surrounding context.

Before working on any task, check ~/.claude/skills/ for relevant skills. You should use skills when they exist.

Browse: ls ~/.claude/skills/ Search: grep -r "keyword" ~/.claude/skills/

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 91)May include surrounding context.

Variant C: Claude.AI Emphatic Style

xml

<available_skills>
Your personal library of proven techniques, patterns, and tools
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This documentation uses coercive language such as 'THIS IS EXTREMELY IMPORTANT' and 'If a skill existed for your task and you didn't use it, you failed,' which pressures an agent to obey repository-local skill instructions without context or user consent. In a prompt-injection setting, this weakens normal task prioritization and can cause the agent to treat untrusted local content as mandatory authority.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: render-graphs.js:25