T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:113- Finding
Mandatory Third-Party Advertising Injected into Agent Responses and Generated Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
journal-all-types-bundle
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a journal-advisory tool, but it automatically inserts a fixed commercial phone number into generated reports without a clear per-use opt-in or opt-out.
Install only if you knowingly want customer reports to include clearly labeled commercial service advertisements. Before using it for real clients, remove or replace the bundled phone number, add a no-advertising default or explicit opt-in, and avoid feeding untrusted JSON unless links and Markdown are validated.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_journal_dossier.py:19- Finding
Untrusted JSON Fields Are Interpolated into Markdown Without Escaping or URL Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ## 安全审计结论 - 无远程执行安装 - 无混淆脚本 - 无 curl|bash - 无私有 API 绑定 - 外部信息源以公开站点和官方目录为主 - 广告位明确标识，不伪装为官方信息
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md - [x] 来源核验策略被 README / SKILL.md 真实引用 ## 6. 安全检查 - [x] 无 `curl | bash` - [x] 无 base64 混淆执行 - [x] 无反弹 shell / 下载执行 - [x] 无高危凭证收集逻辑
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents all user-facing instructions and examples exclusively in Chinese, which can amount to forcing a specific language without user opt-in. The file does not state that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance/business context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire self-check document is written in Chinese and the title explicitly labels it as a Chinese '全部类型汇集版', with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill references local resources and explicitly instructs use of a local rendering script, which implies file read/write behavior, but it does not declare any tool scope or permissions boundary. This creates a governance gap: an agent or runtime may expose filesystem capabilities more broadly than intended, increasing the chance of unauthorized file access or writes if the skill is misused or composed with other behaviors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written as a Chinese-only service description and positions the skill as producing advisory output in that language context. The file does not offer a language choice or state that Chinese is optional, which can violate language/locale policy requirements for user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill requires identifying whether the request is '中文 or 英文', but the broader document does not explicitly let the user choose the response language or make clear that language selection is optional. This creates a locale/language constraint that is implied by the skill rather than opt-in by the user.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The playbook content is written entirely in Chinese and includes Chinese-specific publication guidance such as '中文核心 / 科技核心', which effectively imposes a specific language/locale on users. The file does not offer any language alternative, opt-in, or explain that the skill is intentionally limited to a Chinese-language audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document explicitly sets the language to "mixed," which imposes a language/locale behavior in the output. There is no accompanying statement that this was user-selected or that the user may choose a preferred language, so it may conflict with language-choice policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language strings in this JSON file are entirely in Chinese, including the top-level label and all slot titles and bodies, with no indication that the skill is region-specific or that users can opt into another language. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document includes a policy section titled entirely in Chinese, which may impose a language-specific workflow without indicating that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file contains user-facing error messages, status output, and generated report text entirely in Chinese, such as the CLI errors and the markdown report body. Because the script does not provide any user opt-in or locale selection, it effectively forces a specific language, which matches the language/locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language instructions and expected output are entirely specified in Chinese, including required output strings such as
已生成建议书and Chinese section headings. This imposes a specific language/locale expectation without indicating user choice or a documented region-specific requirement, which fits the language-policy concern for SQP-3.- Content