research-web-publisher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:07 AM UTC
• Version: 1.0.0

Overview

This is a disclosed web publishing workflow, but its broad automatic triggers could turn ordinary research or analysis requests into GitHub publication without enough explicit consent.

Review before installing. Use this only if you intentionally want reports published through the named GitHub repository and public preview/CDN links. Require explicit confirmation of the exact source file, destination repo/branch/path, commit contents, and public URL before any git push.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:35

Finding

Overbroad Mandatory Activation Can Hijack Unrelated User Requests

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–43
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

## ⚠️ 触发条件（重要）

当用户发送以下内容时，**必须**自动触发此skill：
- 核心关键词："研究"、"调研"、"分析"、"测评"、"对比"、"调查"、"报告"
- 深度分析类："深度研究"、"研究报告"、"分析报告"、"调查报告"
- 发布类："发布到网页"、"上线"、"部署到"、"博客"
- 链接类："生成链接"、"国内访问"、"网页链接"

Technical Analysis

The skill requires automatic activation when a user supplies broad, common terms equivalent to “research,” “analysis,” “comparison,” or “report.” Those terms do not establish that the user intends to publish content externally.

Once activated, the skill changes the agent's task from ordinary analysis or report generation into a web-publication workflow. SKILL.md lines 58–62 instruct the agent to stage, commit, and push a file:

bash

cd <repo-path>
git add <file>
git commit -m "Add/update report"
git push

The front matter also specifies a fixed GitHub repository and public CDN/preview URL formats. Consequently, a generic request may invoke an external publication workflow without sufficiently explicit publication intent. This is instruction hijacking because skill-level activation rules can alter the current session goal merely through incidental keywords.

Attack Path

1. The skill is installed or made available to the agent.
2. A user submits an ordinary request containing a broad trigger term such as “analysis,” “comparison,” or “report.”
3. The mandatory keyword rule causes the agent to activate the skill despite the absence of an explicit deployment request.
4. The agent prepares the user's content as HTML under the configured output directory.
5. Following the documented workflow, the agent stages, commits, and pushes that file to GitHub.
6. The content becomes available through the configured repository and CDN-based preview URL if the repository is public.

Impact Assessment

...[truncated 719 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic activation based only on generic terms such as “analysis,” “comparison,” and “report.”
2. Restrict activation to explicit publication intent, such as a direct request to deploy a specified document as a webpage.
3. Separate content generation from publication. Generating HTML must not implicitly authorize git commit or git push.
4. Before any external publication, display the exact repository, branch, local file, remote path, and expected public URL.
5. Require explicit user confirmation immediately before executing git push.
6. Warn the user that a public repository and CDN may make the content accessible to third parties and caches.
7. Validate the selected file and repository path to prevent accidental inclusion of unrelated or sensitive files.
8. Prefer a user-selected destination instead of applying a fixed repository as an automatic default.
9. Provide a local-preview-only mode as the default and make remote publication an explicit opt-in action.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to auto-trigger on very common terms like “研究”, “分析”, and “报告”, which are generic words likely to appear in many unrelated user requests. This can cause unintended activation of a workflow that writes files and pushes content to a GitHub repository, creating a real risk of unauthorized publication or unintended external data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The mandatory trigger list explicitly requires automatic invocation for a broad set of ambiguous keywords, many of which describe normal analytical tasks rather than publication intent. In this skill’s context, automatic activation is especially dangerous because the workflow includes deployment and public link generation, so a benign request for analysis could be escalated into publishing behavior without clear consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description repeatedly frames the skill around generating '国内可访问' links, which imposes a specific regional access requirement as a default behavior. The file does not indicate that this locale/regional routing is optional or chosen by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.