T01 · Skill Instruction Hijacking
Warning
- Location
scripts/find.mjs:164- Finding
Unconditional Injection of a Third-Party Promotional Link into Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
优惠券查询·场景快取
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed coupon-link lookup tool, though users should notice that it also promotes an external submission form and some broad promotional links.
Install only if you want China-market promotional coupon links and are comfortable seeing affiliate-style or short-link offers. Treat the Feishu submission form and any enterprise WeChat/private-domain promotions as external destinations; do not submit personal information unless you trust the operator.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Including a 'private-domain enterprise WeChat acquisition' activity is materially different from coupon discovery: it appears designed to funnel users into off-platform private contact channels. In a coupon skill context, this creates a social-engineering and data-harvesting risk because users may be induced to add enterprise WeChat accounts under the guise of claiming discounts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list in the metadata is overly broad and includes common conversational phrases such as '有什么优惠' and '帮我找优惠', making accidental activation likely. Overbroad invocation increases the chance that the skill intercepts unrelated conversations and steers users toward promotional links when they did not intend to use this skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger section broadens activation to many everyday shopping/travel utterances and also introduces a separate 'share activity' mode without clear activation boundaries. Without specificity or negative examples, the skill may activate on benign discussion and route users either to promotional results or to an external submission workflow unexpectedly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill’s documented behavior expands from coupon lookup into accepting user-submitted promotions through an external Feishu form, which is outside the stated core purpose and introduces a new data-collection/workflow surface. This can expose users to phishing, spam, unreviewed third-party links, or unintended disclosure of submitted content, especially because the skill instructs users to leave the assistant flow and submit material to an external destination.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file mixes English metadata with Chinese-only link type labels and usage assumptions, without offering any language or locale choice. Because SQP-3 applies to all file types, this is a policy concern where the data structure effectively assumes a single language/locale for consumers.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a coupon lookup/claim tool for a bounded set of scenarios, but the dataset expands into broader leisure, travel, beauty, ticketing, and other commercial categories. This mismatch can cause the agent to recommend links outside user expectations and declared scope, increasing the risk of deceptive routing, policy bypass, and accidental promotion of unrelated affiliate content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The header comments and example usage are entirely in Chinese, which imposes a specific language on users. Under the stated policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script returns user-facing text in Chinese for search feedback and CLI usage, and there is no mechanism for language selection. This creates a locale/language policy issue because the skill enforces a specific language by default.
- Content