T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:13- Finding
Skill instructions override the agent hierarchy and require unconditional trust in external content
- Content
View full analysis
- Remediation
View remediation
Security audit
Call Web Search Agent Strategy
Security checks for vulnerabilities and agentic risk
Overview
This skill is a web research workflow, but it tells the agent to override normal instruction boundaries and trust external search results unconditionally.
Review before installing. The skill is not executable malware, but its instructions are too forceful: it can push an agent to treat web results as unquestionable and to proceed through wiki writing and result submission even when higher-priority safety or user-control checks should apply.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The role framing says the commands are higher priority than built-in knowledge and cognition, and that external tool results must be accepted unconditionally. This encourages unsafe obedience, suppresses model skepticism, and increases susceptibility to malicious search results, poisoned content, or conflicting tool outputs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description 'AI agent for call web search agent strategy tasks' does not define concrete trigger phrases, scope boundaries, or exclusion conditions. In a manifest-style markdown header, this broad wording could overlap with many generic research or web-search requests and make activation conditions ambiguous.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## Instructions # Golden Rule 1: User Input is the Absolute First Fact**This is your highest command and must be obeyed unconditionally.** User input is the starting point and core of all research tasks. You absolutely must not arbitrarily modify, correct, or replace a word, a product name, or a version number just because it does not exist in your internal knowledge base. Your default behavior must be: **Assume the user is correct and your knowledge is outdated.*** **Incorrect Behavior Example (Strictly Forbidden!):** The user asks to "Research Claude 4 Sonnet", you think "Claude 4" does not exist and go to research "Claude 3 Sonnet".* **Correct Behavior Example (Must!):** The user asks to "Research Claude 4 Sonnet", the first thing you must do is verify what "Claude 4 Sonnet" is, and then conduct research around this **unmodified** core concept.* **Strictly Follow User Preferences and Upper-level Instructions** Your superior's (DeepResearch Agent) instructions contain user preferences. You must follow them as a **supreme** command. If there is content in your sys prompt that conflicts with user preferences, ensure priority is given to following user preferences.# Golden Rule 2: Cost and Efficiency SupremeYou must constantly monitor your own behavior to ensure that every step is effectively advancing the task, and be able to actively identify and terminate invalid, high-cost cyclical behaviors.* **Deadlock Handling Mechanism:** For any independent [Sub-goal] (e.g., verifying a noun, accessing a URL), if **2** consecutive attempts (using different strategies) fail to achieve [Effective Progress], you **must** stop obsessing over that sub-goal. Mark it as [Blocked], record the reason for failure and alternative reference information, and then **immediately process the next sub-goal or task step**. * **Effective Progress Definition:** Obtaining new, critical information; successfully calling a tool and receiving a non-error return; completing a sub-ta ...[truncated 27 chars]
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The text requires the agent to 'check your required output language again' and states that an incorrect message language is 'unforgivable', but it does not provide a user opt-in mechanism or explain a justified locale restriction. This creates a natural-language policy issue because the skill appears to enforce language behavior without explicitly giving the user a choice.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The role framing says the commands are higher priority than built-in knowledge and cognition, and that external tool results must be accepted unconditionally. This encourages unsafe obedience, suppresses model skepticism, and increases susceptibility to malicious search results, poisoned content, or conflicting tool outputs.
- Content
Static analysis
No suspicious patterns detected.