内容矩阵规划

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:26 AM UTC
• Version: 0.1.0

Overview

This is a content-planning template skill with disclosed report output; its main caveats are default file saving and built-in attribution, not harmful behavior.

Before installing, expect this skill to ask for business/content-planning details and to produce a Markdown report. Confirm the filename and location before allowing it to save, and review the generated report before publishing because the template includes fixed attribution to the book/framework and OPC-AI skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:169

Finding

Mandatory Promotional Attribution Injected into Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58 and 169
Vulnerability Type: Mandatory promotional output injection
Risk Level: Low

Evidence

markdown

> Based on the Chapter 5 framework of "AI Super Individual: A Wealth Creation Handbook for One-Person Companies"

markdown

> This report was generated by the OPC-AI Skill (content-planner), based on the "AI Super Individual" manuscript framework.

The snippets above are English translations of the fixed attribution text at the specified locations.

Technical Analysis

The output template requires generated reports to include fixed references to a book, manuscript, and the OPC-AI Skill brand. These statements are unrelated to the user's content-planning inputs and are included without requiring the user to request or approve attribution.

Because the Skill instructs the Agent to reproduce this template, loading and following the Skill changes the expected output by adding persistent promotional material. This is best classified as T01: Skill Instruction Hijacking, although its scope is limited to output integrity and does not alter safety controls.

Attack Path

1. A user invokes the content-planner Skill.
2. The Agent follows the mandatory report template in SKILL.md.
3. The Agent generates or saves a Markdown report.
4. The fixed book and Skill attribution is inserted into the user-facing report.
5. If the user republishes the report without reviewing it, the unsolicited promotional material is distributed with the content.

No external attacker interaction, code execution, credential access, or privilege escalation is required or enabled by this behavior.

Impact Assessment

The issue affects the integrity and neutrality of generated reports. Users may unknowingly publish branded or promotional attribution that they did not request.

The obtainable scope is limited to modification of generated content. ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory references to the book, manuscript, and OPC-AI Skill brand from the output template.
2. Make attribution optional and disabled by default.
3. Ask for explicit user consent before inserting promotional or third-party branding.
4. Keep default output focused exclusively on information requested by the user.
5. If attribution is necessary for licensing reasons, document that requirement clearly and separate it from generated user content.
6. Add a review test confirming that reports generated with default settings contain no unsolicited branding or promotional statements.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation list includes generic phrases such as “帮我规划内容”, “发什么内容”, and “怎么运营账号”, which are common requests that could arise in many contexts beyond this specific skill. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to write a Markdown file by default without explicit user consent or a prior confirmation step. In agent environments with filesystem or workspace access, this can cause unintended data persistence, overwrite existing files, or create artifacts containing sensitive business information the user did not expect to be stored.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt uses an invocation phrase ('$content-planner') without any defined trigger scope, parameter constraints, or usage boundaries. This can cause unintended or overly broad skill activation and make prompt routing easier to abuse, especially if user input is concatenated around the invocation without clear guardrails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description, trigger phrases, workflow, and output template are all presented exclusively in Chinese, implying a fixed language/locale behavior. There is no statement that the user can choose another language, nor any justification that the skill is intentionally limited to a Chinese-language region or audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The user-facing metadata is in Chinese, but the default prompt forces an English instruction string ("Use $content-planner...") with no indication that the user can choose their preferred language. This may violate language/locale policy expectations because the skill implicitly imposes a language mode without user opt-in.

Content

No source excerpt is available for this finding.