T01 · Skill Instruction Hijacking
Note
- Location
scripts/script.sh:88- Finding
Hardcoded Promotional Content Injected into Skill Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Halving
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a local Bitcoin halving reference tool, with caution needed for static financial content and unsolicited promotional install suggestions.
Use this as a static, educational reference only. Verify current block height, prices, mining economics, and market data from live sources, and do not treat the cycle or strategy sections as investment advice. Review any separately suggested skills before installing them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is narrowly focused on Bitcoin halving analysis use cases. The actual code only outputs canned, generic text about 'halving' and general blockchain/compliance/risk topics. There is no logic, data access, date/block-height computation, Bitcoin-specific analysis, market-cycle modeling, or mining-economics functionality. The code’s primary purpose is materially different from the declared purpose, so this is a clear mismatch.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and advertised purpose say this is for Bitcoin halving countdown and impact analysis, but the body documents a generic 'halving' reference tool with broad blockchain, finance, compliance, and strategy coverage. This mismatch can mislead an agent into invoking the wrong capability, producing unreliable financial or regulatory guidance and increasing the chance of unsafe downstream actions based on irrelevant or fabricated content.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata promises Bitcoin halving countdowns, historical BTC halving impact analysis, mining economics, and 4-year market cycle support, but the script only emits generic static boilerplate. This is dangerous because users or downstream agents may rely on the tool for financial or operational decisions under the false assumption that it provides Bitcoin-specific analysis, causing misinformation, bad automation decisions, or compliance errors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section presents directional market claims and normative investment-style framing about price behavior around halving events without a clear disclaimer that the content is educational and not financial advice. Users may interpret the repeated causal assertions and market-timing narratives as actionable guidance, increasing the risk of financial harm from speculative decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section goes beyond neutral description and includes explicit strategy language such as when to accumulate, take profits, preserve capital, and watch buy/sell signals, but provides no warning about financial risk or suitability. In a Bitcoin market-cycle skill, that context makes the omission more dangerous because users are likely to treat the output as trading guidance rather than general commentary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file-level description claims a blockchain halving reference tool, but the content is generic and not meaningfully tied to Bitcoin halving or blockchain operations. In an agent skill ecosystem, misleading self-description increases the chance that an orchestrator selects this tool for sensitive crypto-analysis tasks and propagates irrelevant or incorrect outputs.
- Content
Static analysis
No suspicious patterns detected.