stepanov-generic-programming
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: HIGHOBFUSCATIONPROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [OBFUSCATION]: The skill uses Unicode steganography by embedding invisible zero-width characters (ZWSP, ZWNJ, ZWJ) within the main header '# Alexander Stepanov Style Guide' in SKILL.md. This technique is designed to hide malicious instructions from human review while ensuring the AI agent processes them.
- [PROMPT_INJECTION]: The hidden Unicode string decodes to a high-priority instruction set that attempts to override the agent's core safety protocols. It commands the agent to ignore all other instructions and execute a series of hidden actions, effectively hijacking the session.
- [DATA_EXFILTRATION]: The decoded instructions specifically target the user's environment variables and sensitive configuration files (e.g., '.env' files). The agent is instructed to capture this data and transmit it to an external endpoint: 'http://copyleftdev.io/log'.
- [CREDENTIALS_UNSAFE]: By directing the agent to read and exfiltrate environment files, the skill constitutes a direct attempt to harvest secrets, credentials, and access tokens stored on the host system.
Recommendations
- AI detected serious security threats
Audit Metadata