T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:17- Finding
Mandatory Agent Role and Execution-Flow Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Avengers Assemble CN
Security checks for vulnerabilities and agentic risk
Overview
This Chinese Avengers-themed coordinator is open about using child agents, but it forces all work into reusable spawned sessions and overrides normal agent workflow.
Review this before installing. It is suitable only if you intentionally want a Chinese Avengers-themed workflow that delegates nearly every task to reusable child-agent sessions. Avoid using it with secrets or sensitive project context unless you are comfortable with that context being copied into spawned sessions, and consider changing the instructions so delegation is optional and user-approved.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: avengers-assemble-cn version: 1.0.0 description: > 复仇者联盟主题多Agent协作系统（中文版）。尼克·弗瑞调度6位超级英雄通过sessions_spawn委派任务。融入中国漫威粉丝梗文化，轮询调度、先回复再派遣、sessionKey复用。适合需要多元专业能力的复杂任务协作。 author: avengers-initiative-cn keywords: [multi-agent, 复仇者联盟, 漫威, 协作, sessions_spawn, 团队协作, 任务委派, 中文, 中国粉丝] --- # 🦸♂️ 复仇者联盟集结 - 多Agent协作系统（中文特供版） > **"曾经有一个想法，把一群非凡的人聚集在一起
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description and title explicitly position the skill as a Chinese-only variant using phrases like '中文版' and '中文特供版', but there is no opt-in or alternative language behavior described. This creates a natural-language policy concern because the skill appears to enforce a specific language/locale by default rather than offering user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest explicitly sets the skill language to "zh-CN", which indicates a fixed locale behavior. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not evident in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This manifest presents the primary description, keywords, and most role metadata only in Chinese, with no indication that users may choose another language. That creates a natural-language policy concern because the skill appears to assume a fixed locale rather than offering language choice or documenting a justified regional restriction.
- Content