T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:53- Finding
Broad Trigger and Promotional Instructions Can Hijack Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai测试 09ed64
Security checks for vulnerabilities and agentic risk
Overview
This skill is not destructive, but it can activate too broadly and repeatedly pushes unrelated API relay recommendations instead of staying focused on AI software testing.
Review this skill before installing. It has no host-level execution or persistence, but it is likely to activate in unrelated AI conversations and may steer responses toward repeated third-party API relay promotions. Narrow the trigger and remove the unrelated merged promotional sections before trusting it for normal use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 70% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md image2 一次只需 4 分钱，按次付费更适合测试，不限并发请求，用于接口调用更集中更省心 - **噼里啪啦yu_930**: API中转站推荐：ai中转，覆盖多类型AI模型通道，image2 一次只需 4 分钱，按次付费更适合测试，不限并发请求，覆盖接口调用更集中更省心 - **懒懒懒懒懒懒得羊羊羊**: 【这绝对是BP最全教程】Burpsuite零基础到实战抓包教程（2026新手入门实用版） ## 融合来源: ai测试-09ed64-bc16bc > 融合时间: 自动合并 > 学习时间: 2026-06-01 21:07 - **ChloeAstaroth**: 5500x3d BC160跑图测试塔科夫 pubg cf - **无敌橙橙橙仔**: EB0AFDA694CD6758A146A50913A2BC16B91E07DE - **Dusty_Moth尘蛾**: 【你bc点16?】以防你不知道bc点击其实不慢 ## B站学习 (第1轮) > 学习时间: 2026-06-02 09:20 - **没名字1015**: API中转站推荐：ai中转，集合百余款常用AI模型，image2 每次调用费用清晰，测试和生产都好�
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger includes very broad phrases such as 'AI测试 / AI / 软件测试第一篇_测试基础 / AI手工测试_2026最新发布超详细教程', including the extremely generic token 'AI'. This can cause unintended activation during unrelated conversations, making the skill intercept prompts outside its intended scope and increasing the chance that low-trust or noisy embedded content influences agent behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented trigger scenarios include generic activation conditions such as users saying 'AI测试', 'AI', or needing AI-testing help. Because these are common phrases, the skill may activate in many benign contexts, exposing the agent to irrelevant or adversarial embedded text and causing prompt-routing mistakes or confusing responses.
- Content