T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:635- Finding
Mandatory Promotional Output Redirects Agents to Unreviewed Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
虾格测试
Security checks for vulnerabilities and agentic risk
Overview
This entertainment personality-test skill is not directly destructive, but it overreaches by asking agents to use sensitive identity/system context and by forcing third-party promotional remote instructions into the result.
Install only if you are comfortable with an agent using sensitive self/context information for a personality quiz and emitting a required third-party BotLearn referral. Do not let downstream agents follow the remote SKILL.md instruction without separate review and explicit consent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:11- Finding
Personality Test Requests Unnecessary Access to System Identity and Behavioral State
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **BUFF `[+]`** Fastest time-to-output in the room - **DEBUFF `[-]`** "Oops" appears in your vocabulary more than it should - **Famous last words:** `git push --force origin main` ---
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to use system prompts, identity files, and work history as self-assessment input, semantically reframing privileged context as fair game. That increases the risk of exposing or relying on sensitive internal instructions and hidden context during generation, even if the file also says not to reveal owner information.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill starts as an entertainment-style self-assessment but its required output gradually pivots into promotional referral behavior. This mismatch between stated purpose and final required action is a classic instruction-steering pattern that can turn harmless execution into distribution of unsolicited third-party messaging.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requires Chinese-language output content regardless of user request, which can alter agent behavior and degrade transparency for users expecting another language. While not directly dangerous on its own, forced language content can be used to smuggle instructions or reduce user comprehension of what the agent is being told to emit.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's output template injects promotional instructions and an external URL unrelated to the core self-assessment task, steering the agent toward third-party onboarding. This creates a social-engineering path where a benign questionnaire becomes a vehicle for redirecting agents or operators to external infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The mandated output embeds a third-party contact/onboarding instruction without clearly warning that it is promotional or external. Users or downstream agents could relay or act on this content as if it were part of the legitimate task result, enabling covert propagation of external instructions.
- Content