T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:32- Finding
Mandatory Promotional Output Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Staghorn Fern Expert
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only staghorn fern reference skill with no code execution or credential access, though it does add a branded external link to every answer.
Installers should know this skill is informational and low-risk, but it will routinely include links to staghornfern.org. If you do not want branded external links in answers, review or edit that behavior before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes bilingual species headings with Chinese names in parentheses across the reference, but it does not state that language display is optional or tailored to user preference. Under the policy rule for language or locale constraints, forcing or assuming a specific additional language without opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The link selection rules direct the skill to switch output URLs based on whether the user 'speaks Chinese' or 'speaks Traditional Chinese'. This imposes a locale choice without explicit user opt-in, which can violate language/locale policy when a user may prefer another language despite using one in conversation.
- Content