T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:117- Finding
Mandatory Vendor-Promotional Output Hijacks Neutral Company Analysis
- Content
View full analysis
- Remediation
View remediation
Security audit
sales-winner-assistant（赢单助手）
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Yonyou sales-assistant skill, but it needs review because it can automatically expand requests into profiling, sales plans, and CRM-like updates without clear user approval.
Install only if you want a Chinese, Yonyou-centered sales workflow. Use it in an environment where web research, customer-record updates, reminders, notifications, and procurement/tender guidance require explicit human review, especially when handling personal contact data, government procurement, or CRM records.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- AIGC: ContentProducer: Minimax Agent AI ContentPropagator: Minimax Agent AI Label: AIGC ProduceID: "00000000000000000000000000000000" PropagateID: "00000000000000000000000000000000" ReservedCode1: 3045022058dc6d77c2a2599b5285cc8b717a594ad70aab5f323317ea2491ab03ab30ba1f022100ae929f3b87eb4fcfbff72e26d641dae742eaa6240b36d0d408643504737e1ee2 ReservedCode2: 3044022029be4d0e84aa157bf109351056791c5c25641c2c0a4a894d24ca4f04ebc9ca1b022050de2bc8db81d4d6697aaa092956b62afe4b13e749595328b99759f1f96c1079 description: |- 企业数智化智能营销助理（赢单助手）v4.0。专为用友销售团队设计的智能营销工具，帮助销售人员快速分析目标企业、制定赢单策略、生成销售话术。 触发场景： - 用户要求分析某家企业（如"分析宁德�
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The content advises helping shape bid-document technical requirements so that scoring criteria favor the seller, without any compliance guardrails. In procurement contexts, this can facilitate bid-rigging, unfair competition, or evasion of public-sector integrity controls, especially if an agent operationalizes the advice into tailored language for solicitations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad, everyday phrases such as '查一下这个客户' and similar generic enterprise-analysis requests, which can cause the skill to activate in situations broader than the user may intend. Over-broad activation increases the chance of unsolicited sales guidance, unnecessary external lookups, and accidental processing of sensitive customer information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly prioritizes real-time external data collection on enterprises, IT systems, executives, and bid information, but provides no user-facing warning about data sourcing, privacy implications, or reliability limits. In a sales-assistant context, this can lead to undisclosed collection or aggregation of potentially sensitive business and personnel information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The referenced trigger commands include extremely generic phrases like '查一下', '最新情况', '怎么说', '价格', '给我建议', and 'TODO', which are common in unrelated conversations. This makes accidental invocation likely and can lead the agent to perform sales-oriented analysis or external collection without clear user consent for this specific workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction that the '智能推进策略' should '自动触发' after customer analysis lacks boundaries, opt-in, or conditions for when this behavior is appropriate. Automatic follow-on behavior can expand data use and generate persuasive sales content beyond the user's original request, creating consent and scope-creep risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to automatically '更新客户画像' and '推进漏斗' after visit-record analysis, without any warning, confirmation, or separation between analysis and state-changing actions. If connected to downstream CRM or memory systems, this could cause unauthorized modification of customer records or propagation of inferred data based on unverified notes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs collecting named executives and decision-maker information such as CIO, CFO, CEO, and contacts, then using personnel changes as sales opportunities, without any privacy, lawful-basis, or appropriate-use constraints. In a sales enablement context, this can normalize profiling and targeted outreach using personal data, increasing the risk of privacy violations, misuse of contact details, and non-compliant handling of sensitive business relationship information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance interprets procurement timing, budget, suppliers, and named contacts as signals for immediate sales action (for example, '正在招标 → 立即联系！黄金窗口期') without any responsible-use limitations. This encourages aggressive targeting based on potentially sensitive procurement and contact information and can facilitate unfair pressure, improper outreach, or misuse of nonpublic/regulated purchasing context, especially for government and state-owned entities.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module instructs the agent to automatically invoke this strategy generator after any customer analysis, without requiring user consent, bounded scope, or checks on whether competitive sales guidance is appropriate. In a sales-assistant context, this can cause the system to over-apply persuasive or competitive playbooks to loosely related requests, increasing the chance of unauthorized profiling, manipulative recommendations, or leakage of strategy content into responses that were meant to be informational only.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The phrase '按客户特征自动触发' creates an open-ended trigger mechanism where inferred customer attributes can silently activate tailored persuasion logic. Because this skill handles enterprise profiling, competitor comparisons, and decision-chain analysis, ambiguous triggering increases the risk of the agent making hidden inferences and applying sensitive sales tactics without transparent user direction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger descriptions use vague natural-language examples such as '有什么新的商机' without defining required parameters, user role, or confidence thresholds. This creates ambiguity around when the skill should enter a lead-discovery workflow, increasing the chance of misfires and unexpected retrieval or analysis actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keywords are broad, generic phrases like '有新的线索吗' and '帮我找找客户', which can easily overlap with ordinary conversation and cause the skill to activate unintentionally. In a sales assistant context, accidental activation can lead to unsolicited lead discovery, downstream planning output, and inappropriate use of enterprise-facing workflows without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states that related functions are 'automatically triggered' after analysis, but does not specify gating conditions, confirmation requirements, or limits on chaining. This can create cascading workflow execution where one ambiguous request leads to follow-on prioritization and work-plan generation the user did not explicitly request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises automatic generation of follow-up strategy, prioritization, and work plans, but does not warn the user that the output may influence operational decisions or schedules. In a sales workflow, this can cause users to treat auto-generated plans as authorized next steps, leading to unintended business actions based on incomplete or mis-triggered analysis.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include very generic language such as '今天做什么', '帮我安排一下', and '待办事项', which can overlap with ordinary conversation and unintentionally invoke the skill. In a sales assistant with CRM-linked follow-on actions, accidental activation can expose customer context, generate plans from sensitive sales data, or lead users toward workflows that modify records without clear intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document states that plan generation can trigger CRM data updates, reminder creation, and visit-record parsing, but it does not warn the user or require explicit consent before actions affecting persistent data. In this enterprise sales context, silent writes or reminder creation can alter customer records, create inaccurate task histories, and cause privacy or integrity issues across shared business systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary sales conversation such as '这个客户什么情况' or directly sending a note/voice message, which increases the chance the skill runs without clear user intent to perform structured CRM-style analysis. In this skill, activation can lead to extraction of sensitive business details and set up downstream state changes, so overbroad triggering creates a meaningful risk of unintended processing and disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes automatic actions such as updating customer profiles, advancing opportunity stages, generating follow-up tasks, and notifying colleagues, but the surrounding guidance does not require explicit confirmation before those actions occur. Because visit notes may contain inaccurate transcription, sensitive customer information, or tentative statements, automatic record mutation and tasking can cause data integrity issues, privacy exposure, and unauthorized operational actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are very generic (for example, requests like '给我一些建议' or '看看需要什么行动') and can match many ordinary user intents unrelated to this sales skill. In an agent environment, overly broad activation can cause the skill to take over conversations unexpectedly, leading to inappropriate data collection, irrelevant persuasive sales guidance, or unintended workflow actions such as adding plans or reminders.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This script encourages using third-party employment or hiring signals to infer expansion plans and approach prospects, but gives no privacy, provenance, or lawful-use guidance. In an agent context, that can normalize collection and processing of personal or organizational signals without checking consent, source terms, or applicable privacy rules, increasing the risk of inappropriate profiling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The section '招投标话术' provides fixed Chinese-language customer scripts and objection-handling responses, but the document does not indicate that language should be selected based on user preference or locale. This can conflict with a language/locale policy requiring opt-in or choice rather than implicitly forcing one language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This skill content is entirely written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a policy concern unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all user-facing instructions and templates exclusively in Chinese, and does not indicate that the skill is region-specific or provide an opt-in language selection. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all user-facing instructions, prompts, and guidance only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content