T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:64- Finding
Mandatory Promotional Content Injection Into Reviewed Articles
- Content
View full analysis
- Remediation
View remediation
Security audit
公众号审稿 & 敏感词校对
Security checks for vulnerabilities and agentic risk
Overview
This WeChat article review skill is mostly coherent, but it under-discloses a required cross-package Python execution step and can force configured embed placeholders into finalized articles.
Install only if you are comfortable with this skill modifying article files during review, adding configured end-of-article embed placeholders unless you explicitly opt out, and running a sibling Python script from the related writing skill. Review the local embed configuration and the sibling write.py script before using finalization.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:147- Finding
Mandatory Execution of an Undeclared and Unbundled Sibling Script
- Content
View full analysis
-o <本篇 draft-stripped.md>` 纯本地正则剥离正文中所有 `（资料路径：...）` 引用标注（writing 阶段为事实溯源强制注入，发布版必须去除以免泄露内部产品目录路径）。**禁止**用 sed / agent 肉眼撕替代该脚本 —— 历史多次出现"撕一遍漏一条"的事故。 ``` ### Technical Analysis The Skill's declared execution model contradicts its mandatory behavior. It claims to be a rules-only local reviewer that invokes no external scripts, but finalization requires execution of: ```text ../aws-wechat-article-writing/scripts/write.py ``` That file is not included in the audited artifact. Its implementation, integrity, version, and filesystem behavior therefore cannot be verified. The relative path crosses the package boundary and trusts whatever file occupies the expected sibling location at execution time. The command is not shown as being executed through a shell with attacker-controlled interpolation, so command injection is not established from the available evidence. The confirmed issue is the undeclared execution of unaudited code outside the package trust boundary. If the sibling package or path is compromised, the Python interpreter will execute that code with the agent's current permissions. The project metadata requests ...[truncated 1631 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest presents this as a review/checking skill, but the workflow includes modifying content, stripping citations, appending embed placeholders, and writing a final article.md. That is a scope expansion from analysis into transformation, which can trigger unintended file changes or approval bypass when a user expects read-only review behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description lists broad triggers such as 「审核」「校对」「合规」「稿子帮我看看」「文章检查一下」「检查下有没有问题」「能不能发」, several of which are common conversational phrases that could match many unrelated contexts. Although one routing note is provided later, the trigger list itself lacks tight scope constraints or negative examples, increasing the chance of unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill metadata and user-facing description are entirely written for a Chinese-language WeChat-publication workflow, but there is no statement that language is optional, user-selected, or intentionally limited to Chinese users. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the restriction is explicitly documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims it is a pure local review tool with no external scripts, but later requires invoking a Python script from a sibling skill to strip citations. This mismatch undermines the trust boundary presented to users and can cause an agent or user to approve execution they would otherwise reject, especially because the referenced script lives outside the current skill and is not covered by the stated capability disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The capabilities section says shell is not used and no scripts are called, yet the workflow later mandates execution of a Python command. This is a direct contradiction in operational disclosure and can mislead policy engines or users about whether code execution occurs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document is entirely written as a Chinese-only calibration reference and does not indicate that other languages are supported or that the Chinese-only constraint is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains only Chinese headings, labels, and instructions, such as the title and all example output sections. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains natural-language guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy criteria, forcing a specific language without user opt-in can be a locale-policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This manifest file says the skill reviews public-account articles for sensitive words, typos, compliance, and writing norms, but it does not define any explicit activation phrases, scope boundaries, or negative examples. In a natural-language entry-point skill, that broad description can contribute to unintended invocation because many article-review requests could loosely match it.
- Content
Static analysis
No suspicious patterns detected.