security-review

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill includes instructions that tell the agent to "Ignore Claude-specific mode-switch instructions" (an "ignore prior instructions" pattern) and to treat user-invoked skill activation as authorization to spawn subagents/execute the skill protocol as-written, which attempts to override or bypass higher-priority/system-level controls and thus constitutes a prompt-injection risk outside normal skill content.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill contains host/VPS audit steps that instruct running/read-access to sensitive system files and commands (e.g., /etc/shadow, /etc/sudoers, authorized_keys, systemd units, crontabs, /etc/ld.so.preload) and recommends credential rotation/rebuild actions — these checks often require root access and could push an agent to perform privileged reads or follow-up remediation that modify host state, so it poses a moderate risk even though it does not explicitly instruct creating users or bypassing sudo.