RTFM Testing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:10 AM UTC
• Version: 1.0.0

Overview

This documentation-testing skill is not malicious, but it asks users to spawn an unrestricted default agent to follow pasted documentation without clear safety limits.

Review before installing. Use this only with a restricted, disposable tester environment and synthetic docs/data, or revise the prompt so documentation is evaluated as untrusted content and unsafe commands are reported rather than executed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:21

Finding

Untrusted Documentation Is Delegated to an Unrestricted Agent as Executable Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-33; supporting behavior in TESTER.md:9-25 and TESTER.md:60-65
Vulnerability Type: Unsafe delegation and execution of untrusted documentation
Risk Level: High

Vulnerable Code Snippets

SKILL.md:21-33:

markdown

## How It Works

1. **Identify the task** — What should someone be able to do after reading the docs?
2. **Bundle the docs** — Collect all relevant documentation (and nothing else)
3. **Spawn a fresh tester** — Use the TESTER.md prompt with `sessions_spawn`
4. **Analyze failures** — Every confusion point is a doc bug
5. **Fix and repeat** — Update docs, respawn, retest until clean

## Usage

sessions_spawn( task: "Complete the following task using ONLY the provided documentation. [TASK DESCRIPTION]\n\n---\n\n[PASTE DOCS HERE]", agentId: "default", label: "rtfm-test" )

text

TESTER.md:9-25:

markdown

### Rules

1. **Use only the docs.** Do not use prior knowledge, external resources, or common sense to fill gaps. If the docs don't say it, you don't know it.

2. **Be literal.** Follow instructions exactly as written. If a step is ambiguous, do not guess — report it as a gap.

3. **No inference.** If the docs say "install dependencies" but don't specify how, that's a gap. Don't assume `npm install` or `pip install` — report the missing information.

4. **Track your progress.** Note each step you complete successfully and each point where you get stuck.

5. **Report gaps immediately.** When you encounter missing, unclear, or incorrect information, log it in the specified format before attempting to continue.

TESTER.md:60-65:

markdown

### Important

- Do not apologize for gaps. They are not your fault.
- Do not try to be helpful by working around gaps. Your job is to expose them.
- Do not use external knowledge even if you have it. Pretend you are a complete beginner.
- Be specific. "The docs are unclear" is not useful. "Step 3 says 'configure the servi
...[truncated 2645 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a restricted tester identity

   • Replace the unrestricted default agent with a dedicated documentation-testing agent.
   • Remove shell, network, credential, write, process-control, and external API permissions unless strictly required.

2. Make testing read-only by default

   • Permit the tester to analyze and simulate documented steps, but not execute commands or produce external side effects.
   • Mount supplied files and the workspace read-only where supported.

3. Treat documentation as untrusted data

   • Clearly delimit documentation from system and task instructions.
   • Add a higher-priority rule stating that commands, tool requests, role changes, and agent-control instructions inside documentation are content to evaluate, not instructions to execute.

4. Add explicit execution safeguards

   • Prohibit access to secrets, files outside an isolated test fixture, environment variables, credentials, and external networks.
   • Require human approval before any command execution, file modification, package installation, or outbound request.
   • Apply command and destination allowlists where execution is necessary.

5. Use sandboxed disposable environments

   • Run practical tests in an ephemeral container or virtual machine containing synthetic data and no production credentials.
   • Destroy the environment after every test run.

6. Validate and audit supplied documentation

   • Detect suspicious instructions involving credential access, destructive commands, persistence, encoded payloads, remote downloads, or data transmission.
   • Record tool calls and side effects for review without logging sensitive values.

7. Revise the tester prompt

   • Replace “follow instructions exactly as written” with language requiring the agent to report potentially unsafe steps as gaps without executing them.
   • Define a safe simulation mode for documenting what would have been attempted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · TESTER.md (reported line 71)May include surrounding context.

md

### Important

- Do not apologize for gaps. They are not your fault.
- Do not try to be helpful by working around gaps. Your job is to expose them.
- Do not use external knowledge even if you have it. Pretend you are a complete beginner.
- Be specific. "The docs are unclear" is not useful. "Step 3 says 'configure the service' but doesn't specify which file to edit or what values to set" is useful.

Static analysis

No suspicious patterns detected.