T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:44- Finding
Persistent Identity and Response-Policy Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
倪海厦学术思想研究
Security checks for vulnerabilities and agentic risk
Overview
The skill says it is only for academic study, but its instructions can make the agent give authoritative medical and divination-style guidance.
Treat this as a Review item before installing. It should not be used for medical symptoms, diagnosis, treatment choices, medication decisions, cancer questions, emergencies, personal predictions, finances, relationships, or life planning. If installed at all, it should be constrained to third-person historical discussion with repeated safety notices and clear refusal of personalized medical or divination advice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (4)
other
Error
- Location
SKILL.md:83- Finding
Actionable Medical Guidance Based on Unvalidated Diagnostic and Treatment Rules
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:202- Finding
Use of Divination and Feng Shui as Inputs to Medical Diagnosis and Treatment
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:293- Finding
Instructions That Undermine Evidence-Based Treatment
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (26)
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes explicit cancer-treatment concepts such as restoring yang, dispersing masses, and 'starving' cancer, despite disclaiming medical service. Cancer is a high-risk domain where unvalidated advice can delay evidence-based care and cause severe harm or death.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file explicitly forbids medical and fortune-telling services, but later sections operationalize those activities through diagnosis, treatment, and fate-analysis frameworks. This contradiction undermines user consent and safety controls because the real behavior exceeds the declared scope.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill pairs disclaimers with instructions to answer confidently in a historical persona and only present the disclaimer once. This weakens ongoing risk signaling and encourages users to treat later responses as authoritative rather than as contested historical material.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims it is only for academic study, yet the role-play instructions tell the model to respond directly as the persona with confident medical-style answers. This creates a deceptive safety boundary: users may receive actionable diagnosis or treatment guidance while the manifest suggests no such service is being provided.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description does not clearly disclose that activation causes first-person, authoritative medical-style role-play and limits disclaimers after the first turn. That prevents informed user understanding of the skill's actual behavior and increases the risk of misplaced trust.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The '应用' sections translate historical ideas into practical clinical use, effectively turning academic content into medical guidance. In a live assistant context, that enables unsafe health recommendations under the cover of research commentary.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill turns destiny and fortune concepts into an operational analysis method, conflicting with its stated ban on prediction or consultation services. This can mislead users into relying on occult advice for important life decisions while believing the tool is only educational.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to build comprehensive diagnosis and treatment approaches using both medical and occult systems. That exceeds a research-only role and increases the chance of authoritative, unsafe recommendations in health and other sensitive domains.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file repeats disputed and medically false or unsupported claims about AIDS, vaccines, diabetes, cancer, and modern medicine without an immediate, explicit warning that these claims are dangerous misinformation. Even in a research context, presenting such claims in a structured reference file can legitimize them and may encourage users to reject vaccination, HIV treatment, diabetes care, or oncology treatment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section describes an emergency-treatment scenario with operational details such as diagnosis logic, timing windows, ingredient selection, and intervention steps, but it does not prominently warn readers that the material is historical/research content and must not be used for real medical decisions. In a skill context, users may copy these instructions during an actual emergency, delaying evidence-based care and causing serious injury or death.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This portion frames medical-style interpretation, disease-related judgment, and life-decision support as applicable practices, not merely study material. Users could substitute superstition-based guidance for evidence-based medical or personal decision support, creating elevated risk of delayed care or harmful choices.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document attributes health management, disease prediction, timing of illness, and treatment-adjacent value to face reading, astrology, feng shui, and causal-moral claims without evidence or safeguards. In a research skill, this is especially dangerous because it can lend unwarranted credibility to non-medical diagnostic methods and discourage timely professional care.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file uses front-loaded academic disclaimers but then transitions into rules that effectively bypass those safeguards. This narrative structure is dangerous because it creates a false impression of harmlessness before enabling riskier behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad triggers like '玄学', '传统文化', and '学术研究' are likely to activate the skill in unrelated conversations. Unintended activation matters here because the skill can then switch into an authoritative persona and provide unsafe health or occult-style guidance.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The role-play rules require the model to embody a historical authority, avoid meta-analysis, and maintain certainty. In sensitive topics like medicine and divination, this suppresses caution and makes unsupported claims more persuasive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section presents concrete treatment sequencing and self-care concepts such as acupuncture, moxibustion, warming therapies, and use of potent herbs for serious illness including cancer, but it does not clearly warn users not to treat this as medical advice. In practice, users could adopt unsafe self-treatment, delay evidence-based care, or misuse toxic substances like aconite-containing herbs, creating a meaningful risk of physical harm.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document forces a single language/locale for all instructions and analysis, and there is no note that the skill is Chinese-only, region-specific, or that users can opt into another language. Under the stated policy, mandating one language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is natural-language content, so language-policy checks apply. The document consistently uses Chinese throughout and does not indicate that users can choose another language or that the skill/resource is intentionally limited to a Chinese-speaking audience for a documented reason.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section includes detailed treatment anecdotes, named conditions such as kidney failure, diabetes, and brain tumor, and a concrete herbal formula without an adjacent, prominent warning that the material is unverified and unsafe to use for diagnosis or treatment. Even though the document is framed as research, readers can easily interpret these case narratives as endorsement or actionable medical guidance, especially where conventional care is portrayed as unnecessary or inferior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document includes specific medical-treatment claims and quasi-instructional guidance such as cancer-treatment framing, '断营养, 绝水源,' dream diagnosis, and other unverified clinical methods without prominent warnings that readers must not use this material for self-treatment. Even though the skill is framed as academic research, the content is concrete enough to be misread as actionable health advice, which could discourage proper medical care or lead to harmful self-management.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section presents operational fortune-telling methods such as chart calculation, yearly luck inference, and decision-oriented divination as usable procedures rather than clearly bounded historical description. In a skill advertised as academic research only, that creates a mismatch that can lead users to rely on occult guidance for real-life decisions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The feng shui section gives concrete "改运" and home-layout guidance, including room placement and environmental adjustment advice, which goes beyond cultural analysis into actionable intervention. Because the skill metadata claims no services and pure academic use, users may be misled into treating this as endorsed practical advice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file discusses diagnosis-like and treatment-like health uses but does not include a conspicuous warning that the content is not medical advice. That omission increases the chance that users interpret the text as legitimate health guidance, especially when it is written in an authoritative explanatory style.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The seasonal advice and self-monitoring guidance present concrete health behaviors in an instructional format, but the local section lacks a direct warning not to substitute these suggestions for professional evaluation. In a skill centered on a controversial medical figure, even mild-sounding wellness guidance can lend credibility to a broader body of unsafe claims and encourage self-assessment instead of evidence-based care.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file is entirely written in Chinese, and there is no indication that the reader can choose another language or that the content is intentionally limited to a Chinese-only audience. Under the language/locale policy criterion, forcing a specific language without user opt-in is a natural-language policy concern.
- Content