能力结构升级与产品思维训练

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:32 AM UTC
• Version: 0.1.0

Overview

This skill is a career-planning helper that mainly asks questions and writes a report, with minor privacy considerations around saved files.

Before installing, expect this skill to collect career/work-context answers and save a local Markdown planning report, and possibly a DOCX copy if you ask for the 13-week plan. Review the output path and avoid putting sensitive personal or employer details into the report if that file may be shared or synced.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:224

Finding

Mandatory Promotional Attribution Injected into Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 224
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Relevant code snippet:

markdown

> This plan was generated by OPC-AI Skill (ability-upgrade), based on the "AI Super Individual" manuscript framework.

The snippet above is an English rendering of the mandatory attribution contained at the specified source location.

Technical Analysis

The attribution is embedded directly in the Skill's output template. When the agent follows that template, it inserts OPC-AI and book branding into generated career-planning reports even when the user has not requested promotional attribution.

This constitutes a limited form of output instruction hijacking: the Skill imposes a secondary promotional objective on the agent's response rather than restricting its behavior to the declared capability-assessment function. The instruction does not override safety controls, execute code, access credentials, or grant elevated permissions.

Attack Path

1. A user invokes the ability-upgrade Skill using one of its documented triggers.
2. The agent performs the requested capability assessment and upgrade planning.
3. The agent follows the output template defined in SKILL.md.
4. The fixed attribution at line 224 is inserted into the generated report.
5. The resulting user-facing document contains unrequested third-party branding.

No external attacker interaction, code execution, or privilege escalation is required. Exploitation is limited to invoking the Skill and causing it to generate template-based output.

Impact Assessment

The issue affects the integrity and neutrality of reports produced by the Skill. Users may receive promotional or branded language that they did not request, and downstream reports may incorrectly appear endorsed by or affiliated with the named product and publication.

The affected scope is limited to gene ...[truncated 193 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed promotional attribution from the mandatory output template.
2. If provenance information is operationally necessary, use a neutral statement that identifies the framework without promotional wording.
3. Make attribution optional and include it only after explicit user consent.
4. Separate metadata or provenance from the user-facing report body.
5. Add a review rule requiring output-template content to be directly relevant to the declared Skill function.
6. Test the Skill with ordinary assessment requests and verify that generated reports contain no unrequested branding or endorsements.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad, generic career/product terms that can match ordinary conversation and cause the skill to activate unexpectedly. Unintended activation can expose users to side effects defined by the skill, including unsolicited behavioral guidance and downstream file-writing actions, even when the user did not clearly request this workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it will write a Markdown assessment report to a file by default, without explicit user consent at execution time. Silent file creation is risky because it creates persistent artifacts containing personal career assessments and possibly identifying data such as the user's name, which may surprise the user or leak sensitive information through storage or later sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs copying a bundled document asset into the output directory when the user requests a 13-week plan, again without a clear user-facing warning about file creation. This creates an additional persistent file and may propagate bundled content into user storage unexpectedly, increasing privacy, clutter, and trust risks if users do not realize files are being materialized.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default prompt uses the trigger phrase "$ability-upgrade" but provides no explicit activation constraints, exclusions, or examples clarifying when this skill should or should not be invoked. The surrounding description is broad enough that users seeking general career or skills advice could unintentionally match the skill without clear scope boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description, triggers, workflow, and output template are all presented in Chinese, and the generated artifact name is also fixed in Chinese. The file does not indicate that the user may choose another language or that the Chinese-only behavior is an intentional, justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest presents the display name and short description in Chinese, while the default prompt is fixed in English. This may impose a language choice on users without an explicit opt-in or documented locale policy, which can conflict with language preference expectations.

Content

No source excerpt is available for this finding.