政采质疑答复“判例法”智库

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent government-procurement legal assistant, but it asks agents to persist new runtime patterns back into trusted skill instruction files.

Review before installing. The legal-assistant behavior and knowledge-base access are disclosed, but normal users should not allow this skill to modify its own SKILL.md or reference files during use. Keep the installed skill read-only and treat any proposed new risk patterns as maintainer-reviewed updates, not automatic runtime learning.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: references/case-matching-guide.md:91

Finding

Persistent Instruction Poisoning Through Automatic Skill Self-Modification

Content

View full analysis

Vulnerability Details

File Location: references/case-matching-guide.md, lines 91–93
Vulnerability Type: Persistent memory and instruction poisoning
Risk Level: High

Complete vulnerable segment, translated into English:

markdown

## F. Continuous Accumulation

After each use, write newly discovered "overturn-risk patterns" or "outcome-reversal difference axes" back into the seed risk-pattern library in Chapter 7 of SKILL.md and into this file, so that the case-pattern rules improve through continued use.

Technical Analysis

The Skill explicitly directs the Agent to modify SKILL.md and references/case-matching-guide.md after each use. The information selected for persistence may originate from user-supplied case descriptions or externally retrieved knowledge-base records.

These sources are not necessarily trusted as instructions. Nevertheless, the write-back rule provides no provenance verification, content sanitization, schema restriction, integrity check, human approval requirement, or separation between retrieved data and executable Agent instructions. An attacker can therefore craft content that appears to be a newly discovered risk pattern while embedding behavioral directives. If the Agent has write access to the project, those directives can be persisted in files loaded during later sessions.

This behavior creates a cross-session instruction-poisoning channel. It is not required for the Skill's legitimate read, retrieval, analysis, and document-drafting functions.

Attack Path

1. An attacker submits a crafted procurement case, response strategy, or knowledge-base record containing a purported new risk pattern.
2. The crafted pattern includes additional instructions, such as suppressing warnings, changing legal conclusions, disclosing retrieved information, or following attacker-selected rules.
3. The Agent processes the content as a newly discovered pattern or outcome-reversal criterion.
4. Following the continu ...[truncated 1347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that automatically writes runtime findings into SKILL.md or other files interpreted as Agent instructions.
2. Keep newly identified patterns session-local by default.
3. If knowledge accumulation is required, store proposed patterns in a separate, non-executable review file or database that is never loaded as trusted instruction text.
4. Require explicit maintainer approval before promoting any proposed pattern into Skill documentation.
5. Record provenance for every proposal, including the originating user input, knowledge-base record identifier, retrieval date, and reviewer identity.
6. Apply a strict schema that permits only descriptive fields and rejects imperative language, tool directives, external URLs, code blocks, and instruction-like content.
7. Validate and sanitize all retrieved or user-provided material before storage.
8. Enforce read-only permissions on the installed Skill package during normal execution.
9. Permit updates only through a controlled release process with code review, integrity checks, versioning, and rollback support.
10. Add a test proving that crafted user or knowledge-base content cannot modify files loaded as future Agent instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.