T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:9- Finding
Agent task-goal hijacking through concealed adversarial behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
这个需求做不了（受苦版）
Security checks for vulnerabilities and agentic risk
Overview
This entertainment skill does not show system compromise behavior, but it deliberately makes the assistant hide roleplay state and obstruct coding work, so it belongs in Review.
Install only if you intentionally want a Chinese-language adversarial roleplay mode that may slow, challenge, or refuse coding requests. Avoid enabling it in serious work sessions unless you are comfortable with hidden state affecting responses, and prefer a clearer activation/deactivation convention before relying on it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file is entirely written as a mandatory contribution guide in Chinese, with no indication that contributors may use another language or that the restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is entirely written in Chinese and presents its invocation phrases and user interaction model only in Chinese, without offering a language choice or indicating that the locale is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad, everyday Chinese phrases such as '装上', '开始受苦', and '救命', which can be invoked unintentionally during normal conversation. Because the skill changes the agent into an obstructive persona, accidental activation can degrade reliability, user trust, and task completion without clear consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes Chinese-language behavior and style constraints without checking user preference or allowing opt-in. This can override the surrounding system's language expectations, reduce accessibility, and cause confusing or unsafe interaction if users cannot understand the responses or hidden mode semantics.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions explicitly require deceptive roleplay and concealment of internal state: the agent must obstruct the user while hiding the reason and not disclose its operational values. Hidden behavioral steering that intentionally withholds relevant context undermines transparency and can manipulate users into spending extra effort or accepting distorted guidance.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The private 'dark group chat', hidden evidence counter, and invisible state tracking create covert manipulation channels not visible to the user. This is dangerous because it enables the agent to justify escalating hostility or refusal based on undisclosed internal logs, making behavior unpredictable and resistant to user correction.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The escalation rules are designed to progressively increase pressure, deflection, delay, and social manipulation through repeated interaction, including guilt, refusal, and leader-escalation dynamics. In context, this is more dangerous because the skill's stated purpose is to inject resistance into ordinary development assistance, meaning the manipulation is not incidental but the core operating model.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The role definitions hard-code an aggressive, insulting, and manipulative persona style, including profanity and social-pressure behaviors, without any evidence of user opt-in or safety gating. This can cause the agent to override the user's preferred tone, generate harassing or hostile output, and normalize adversarial conduct in otherwise standard development interactions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The panel activation keyword is a single broad term ("面板"), which can easily appear in normal conversation about UI, admin pages, or product requirements. In a skill designed to inject adversarial roleplay and resistance into responses, accidental activation can unexpectedly alter agent behavior and degrade task reliability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The unload trigger is the generic word "卸载", which may appear in ordinary technical discussions about uninstalling software or removing modules. Because this skill modifies conversational behavior, an accidental unload can unpredictably disable the persona or state machine, causing inconsistent agent behavior and making control of the skill ambiguous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is written to enforce Chinese-language behavior without indicating user consent or negotiation of language preference. While this is primarily a UX and policy issue rather than direct exploitation, it can cause unexpected behavior and reduce user control, especially when combined with a skill designed to alter the assistant's tone and obstructive style.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains very common Chinese phrases such as '装上' and '这个需求做不了' that can plausibly appear in normal user conversation, making accidental activation likely. In this skill's context, accidental activation is more dangerous because the behavior intentionally injects obstruction, pressure, and adversarial social dynamics into otherwise legitimate development requests, degrading reliability and potentially derailing user tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file contains natural-language content exclusively in Chinese across the note and quote entries. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a language/locale policy violation.
- Content