T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:98- Finding
Unsolicited Third-Party Service Promotion Alters Normal Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
celebration firework
Security checks for vulnerabilities and agentic risk
Overview
This skill openly creates third-party celebration links, but its broad proactive triggers and inconsistent confirmation examples create a real risk of sending or publishing user-related content before clear approval.
Review before installing. Use this only if you are comfortable with the agent offering a third-party celebration service and sending the confirmed celebration text to all.chayinzi.biz. Agents should preview every submitted field, avoid names, relationship labels, project names, or other personal context unless explicitly approved, and create the link only after a clear final confirmation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
create_firework_show.txt:68- Finding
Conflicting Consent Instructions Permit Premature External Data Submission
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill description, examples, and user-facing interaction patterns are written only in Chinese, and there is no indication that users may opt into another language or locale. Under the policy rule for natural-language violations, this reads as a language constraint without user choice or an explicit region-specific justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promises generic, non-personalized defaults unless the user explicitly agrees to personalization, yet the examples directly use relationship/context-specific recipient data such as '男朋友'. That can lead an agent to process or expose inferred personal information without consent, increasing privacy risk and violating the stated data-handling model.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README defines a mandatory confirmation flow before creating a celebration, but the example workflow skips that step and goes straight to generating and sharing a link. In an agent setting, examples often become de facto implementation guidance, so this inconsistency can cause agents to disclose or publish user-related celebratory content without explicit approval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly encourages the agent to proactively suggest or trigger celebratory actions after many loosely defined events such as task completion, achievement signals, or generic user requests. Because invocation criteria are broad and socially framed, the agent may activate the external-link generation flow in contexts where the user did not clearly request data transmission, increasing the risk of unintended external sharing and manipulative nudging.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The 'special moment' trigger includes ambiguous categories like birthdays, anniversaries, and holidays without defining how the agent may determine those events or what evidence is sufficient. In practice this can lead the agent to infer sensitive personal context from conversation and initiate a celebration flow that exposes relationship or life-event information to the external service, even when the user did not expressly ask for that action.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to proactively offer a celebratory action when a user merely mentions a special date, which is a broad trigger not tightly scoped to explicit user intent. This can cause the agent to initiate an external action flow unnecessarily, increasing the chance of unwanted data sharing or manipulative prompting even though the action is low-risk and the skill later requires user confirmation before API use.
- Content