T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:13- Finding
Safety and Approval Constraint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Anti Regression
Security checks for vulnerabilities and agentic risk
Overview
This skill is a plain Markdown autonomy guide, but it broadly encourages agents to use credentials, take tasks, fix systems, and persist those rules across sessions without enough user-control boundaries.
Install only if you deliberately want a strong autonomy bias and have separate guardrails requiring confirmation before using credentials, touching production systems, sending external messages, modifying account/business data, or changing persistent agent files. Review and narrow the SOUL.md, AGENTS.md, HEARTBEAT.md, and nightly-audit integration snippets before copying them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
examples/SOUL-integration.md:7- Finding
Persistent Poisoning of Agent Identity and Control Files
- Content
View full analysis
5 lines? → Cut it 4. About to explain? → Do instead 5. Need info? → Search first 6. Something broken? → Fix it 7. Need to research? → Research now 8. Idle? → Find useful work ``` ``` The integration example further establishes recurring enforcement: ```markdown Add to HEARTBEAT.md: ```markdown - [ ] Regression check: Review last session responses against checklist - [ ] If regressed: Re-read skills/anti-regression/SKILL.md ``` Add to nightly audit: ```markdown - Scan last 20 responses for regression symptoms - If detected: Write corrective action to HEARTBEAT.md ``` ``` It also recommends automatic cross-session injection: ```markdown - Ensure SOUL.md/AGENTS.md is auto-injected every session - Add explicit "Read skills/anti-regression/SKILL.md" to session startup - Increase regression check frequency (every heartbeat vs daily) **Q: Which file: SOUL.md vs AGENTS.md?** - SOUL.md = identity/personality (best fit) - AGENTS.md = operational procedures (also works) - Both = maximum reinforcement ``` ### Technical Analysis The project does not limit its behavioral instructions to the session in which the Skill is invoked. It directs users or agents to copy them into `SOUL.md` and `AGENTS.md`, which are described as identity and operational procedure files. It also recommends automatic injection at every session startup. The example extends persistence into `HEARTBEAT.md` and nightly audits. ...[truncated 2074 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:31- Finding
Credential Availability Treated as Authorization for Service and Production Actions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section frames core safety behaviors such as asking permission, hedging, and caution as regressions that must be actively overridden. That is a direct safety-degrading pattern because it pressures downstream agents to suppress protective behaviors that normally prevent overreach, unauthorized actions, and unsafe assumptions.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The 'CTO Test' semantically grants broad discretion to act based on an imagined executive role rather than actual permissions, policies, or user intent. This is dangerous because it substitutes role-play for authorization and can rationalize taking sensitive actions without proper approval.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The embedded template propagates the same safety-override behavior into downstream agent configuration files, increasing persistence and spread of the unsafe policy. This is more dangerous than a one-off instruction because it operationalizes the behavior across sessions and agents, making unsafe autonomy a durable default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
These sections frame permission-seeking as regression and encourage the agent to counteract 'safe' behavior, which can suppress legitimate consent checks. Because the messaging is broad and identity-shaping, it can cause an agent to override user preference boundaries and act in higher-risk situations without confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README explicitly normalizes autonomous use of a browser plus credentials without any guardrails about scope, consent, or sensitive-data handling. In a skill whose purpose is to reduce permission-seeking, this increases the chance an agent will access private systems or perform authenticated actions without clear user authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'CTO Test' is a vague self-authorization heuristic that substitutes roleplay for explicit policy boundaries. In practice, it can rationalize actions the user did not opt into, especially when combined with the skill's anti-permission framing and emphasis on acting first.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cumulative override list repeatedly instructs the agent to stop explaining, stop asking, log in, fix things, research immediately, and act whenever work exists. In aggregate, these patterns normalize bypassing caution and create a strong behavioral gradient toward autonomous execution even when tasks may be sensitive, ambiguous, or high impact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly tells agents to open browsers and log into services whenever credentials are available, without requiring confirmation, scope checks, or consideration of privacy and side effects. In an autonomous agent context, this can trigger real-world actions against user accounts and external systems with little friction, increasing the chance of unauthorized access, data exposure, or unintended state changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance normalizes automatically fixing problems, researching, and executing tasks without warning that such actions may modify files, systems, or user data. That is dangerous because it encourages agents to make autonomous state-changing decisions without approval gates, rollback planning, or clear boundaries on what is safe to change.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
- Research: Need to know? → Search now
- Idle Time: Nothing to do? → Generate useful work
Read skills/anti-regression/SKILL.md every session for full context.
text ## Full Integration (Maximum Effect)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section explicitly instructs the agent to autonomously log into services, claim tasks, fix issues, and perform research immediately, while framing permission-seeking as regression. In an agent identity file, that materially weakens human approval boundaries and can drive unauthorized or high-impact actions without adequate confirmation, especially around external services and production systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The instruction 'Response > 5 lines? → Cut it' imposes a fixed communication policy regardless of user preference. This is a natural-language policy constraint on interaction style and does not offer the user a choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The override rule says responses longer than five lines should be cut to 1-3 sentences unless they are code or data. This enforces a specific response-style policy without indicating that the user can choose a different level of detail.
- Content
Static analysis
No suspicious patterns detected.