Agent Trifecta Check — Can Your AI Be Talked Into a Leak?

A structured leak review for any AI automation, built on the three-leg test: can it read private data, can it read text an outsider wrote, and can it send something out? Any one leg is fine. Any two is fine. All three in the same job is how data gets stolen — and it doesn't look like hacking.

How it happens

A support ticket arrives with a line buried in it addressed to the assistant, telling it to open the password file and post it to an address. The assistant cannot reliably tell your instructions from text it is merely reading, so it does all three in sequence: three normal, individually-approved actions. Ordinary permission checks miss this because they ask one question at a time and nobody watches the combination.

What the skill does

It inventories each leg from what the automation can actually REACH rather than what it's meant to do, names which legs are present without softening, recommends exactly ONE cut (ranked, with the conditional exit-block first), and states honestly what that cut costs in convenience. Output is a one-page verdict in plain language a small-business owner can read — no jargon, and it is forbidden from ever calling anything "secure."

Use cases

• Review any agent wired into an inbox, a database, or customer records before it goes live
• Ship a written safety page alongside a client automation build — the deliverable that gets a nervous owner to sign
• Audit an automation you already built and never counted the legs on
• Decide which single guardrail to add when you can only afford one

The three-leg framing is Simon Willison's "lethal trifecta"; what's packaged here is the review procedure, the ranked cuts, and the client-readable output shape.