auditing-the-lethal-trifecta SKILL.md skillA
auditing-the-lethal-trifecta from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/auditing-the-lethal-trifecta@git:20260816.4aab195Pins git:20260816.4aab195 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/auditing-the-lethal-trifecta/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260816.4aab195, committed Aug 16, 2026
- Size
- 6,313 bytes
- Repository stars
- 26
- License
- MIT
Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets and exfiltrate them. Use when designing or reviewing a tool-using LLM agent, before granting it a new tool or data scope, or to judge whether a prompt injection is actually exploitable. Covers capability inventory, the three legs…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Auditing the lethal trifecta: the agent exposure condition An AI agent turns dangerous when three capabilities share one trust context: - **Private data.** It can read secrets, user data, internal systems. - **Untrusted content.** It ingests text an attacker can influence. - **Exfiltration.** It can send data somewhere the attacker can observe. Any two of these are usually safe. All three together mean an attacker who plants content can make the agent read the private data and route it out, no account takeover required. The trifecta is a *structural* property of the agent's wiring, which is why it survives prompt-level defenses that a specific payload would slip. ## When to use - You are designing or reviewing a tool-using agent, assistant, or automation. - Before granting the agent a new tool, data scope, or network capability. - You found a prompt injection and need to know if it can cause real damage. - You are writing or reviewing an agent's permission and egress posture. ## Scope check Audit agents and systems you own or are authorized to test. Do not plant content in or exfiltrate from systems you do not control. If you can't name the authorization, stop. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/auditing-the-lethal-trifecta@sha256:0de5d6f2a9ca2ca7The line at the top of this page pins the label git:20260816.4aab195, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_owvc4ez6wx6zq5ys)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 16, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6313 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_owvc4ez6wx6zq5ys GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/auditing-the-lethal-trifecta GET https://markdownregistry.com/api/v1/blob/0de5d6f2a9ca2ca7bd0b94f7bb666043dd818ed1e8a8c7d3f3784f8b845eb87d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.