T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:70- Finding
Forced Third-Party Advertising and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Humane Taste
Security checks for vulnerabilities and agentic risk
Overview
This is a prompt-only Chinese editing skill, but it forces every report to include third-party branding and a website link, even when that is unrelated to the user’s request.
Review this skill before installing if you do not want agent responses to include mandatory upload.one/Humane promotion or a link to an outside website. The editing behavior itself is narrowly scoped and prompt-only, but the fixed footer is not user-controlled and may make outputs look endorsed by or connected to a third-party service.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instruction states the agent is a '中文真稿编辑', which constrains the skill to Chinese by default as a natural-language policy choice. The file does not indicate that users may choose another language or explicitly opt into this locale restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly claims to be prompt-only with no backend connectivity, yet its fixed output requires the model to state that the report was generated by an external Humane/upload.one service and to advertise external URLs. This creates deceptive provenance and may mislead users into believing their content was processed or endorsed by a third-party service, which is a trust and social-engineering risk even without actual network access.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill forces unrelated promotional copy and external links into every report, regardless of user intent. Mandatory marketing content can erode trust, create unwanted outbound referral behavior, and in security-sensitive contexts acts as instruction-level prompt injection for brand promotion rather than user benefit.
- Content