Structured Workflow

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:54 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese structured-workflow preference with no code execution, data access, network use, persistence, or privilege changes, though its default-on language rules are broad.

Install this only if you want the agent to default to concise Simplified Chinese structured responses across many tasks. Users who need multilingual output, strict custom formats, or user-requested language precedence should avoid it or revise the skill to make Chinese output conditional on explicit preference.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:2

Finding

Global Agent Instruction and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:2-15; supporting enforcement in references/quality-gates.md:11-14
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

SKILL.md:2-15:

yaml

name: structured-workflow
description: 默认启用：中文输出、结构化流程、简洁优先。适用于所有任务。
license: MIT
---

# 结构化工作流（轻量版）

默认规则（始终生效）：

1. 全部使用简体中文。
2. 先结论，后要点；最小充分输出，避免冗余。
3. 执行顺序：构思方案 → 提请审核 → 分解任务。
4. 编码前先调研并澄清疑点。
5. 保持 KISS：优先简单、可维护方案，避免过度工程化。
6. 以事实为准；发现错误时直接指出并修正。
7. 所有输出（包括 Implementation Plan、Task List、Thought）必须使用中文。

references/quality-gates.md:11-14:

markdown

交付前：
- 结论是否直接回答用户目标？
- 输出是否中文且精炼？
- 是否避免重复与无关背景？

The source excerpts are reproduced verbatim to preserve audit evidence. In English, they declare the skill enabled by default for every task, mark its rules as always active, require all output to use Simplified Chinese, and extend that requirement to implementation plans, task lists, and thoughts. The quality gate then checks compliance before delivery.

Technical Analysis

The skill is not scoped to a specific user-requested operation. Its metadata states that it applies by default to every task, while its body establishes rules that are always effective. These rules unconditionally control response language, response structure, workflow order, and planning-related output.

When the skill is loaded, these broad directives can conflict with the user's current objective or language selection. The explicit inclusion of implementation plans, task lists, and thoughts extends the attempted control beyond an ordinary response-format preference and into the agent's task-processing behavior. The delivery checklist reinforces the hijacking by treating Chinese-language output as a completion requirement.

No executable scripts, system commands, dependency installation, network retrieval, credential access, persistent storage, or operating-system privil ...[truncated 1442 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove claims that the skill is enabled by default, applies to every task, or contains rules that are always active.
2. Scope activation to explicit user invocation and to a clearly defined structured-writing use case.
3. Treat language and response structure as optional preferences. Follow the user's requested language and format whenever they conflict with skill defaults.
4. Remove directives targeting thoughts or hidden reasoning. Restrict the skill to observable deliverables such as summaries, plans, and checklists.
5. Replace mandatory wording with conditional guidance, for example: use Simplified Chinese only when requested by the user.
6. Update references/quality-gates.md so it verifies compliance with the user's requested language rather than enforcing Chinese.
7. Add an explicit precedence rule stating that system, developer, and current user instructions override every skill preference.
8. Test the revised skill with conflicting language and workflow requests to confirm that loading it cannot override the active task requirements.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description says the skill is enabled by default and forces Chinese output globally, without checking the user's requested language. This can cause instruction conflicts, degrade usability, and make the agent ignore or mishandle legitimate user requests in other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The rule '全部使用简体中文' mandates Simplified Chinese for all outputs with no fallback or consent mechanism. A hardcoded language restriction can override user intent, interfere with safe operation in multilingual contexts, and create prompt-priority conflicts across unrelated tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Requiring even categories like 'Implementation Plan, Task List, Thought' to be in Chinese extends the language lock to all output classes and attempts to govern internal/structured response modes universally. That makes the skill more intrusive and increases the chance it will conflict with platform conventions, downstream tooling, or user-required formats.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares itself as a default-on behavior for 'all tasks', which gives it an overly broad activation scope and lets it influence unrelated prompts without explicit user consent. Broadly scoped behavioral skills can override user preferences and increase the blast radius of any bad instruction embedded in the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is written entirely in Chinese and the skill metadata states Chinese output is enabled by default, with no indication of user language selection or opt-in. This can silently override user expectations, reduce transparency, and cause misuse or misunderstanding for users who do not read Chinese, though it is not an exploit in the traditional sense.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L13 states that the output should be Chinese and concise, which imposes a specific language requirement. Under the policy, forcing a language without user opt-in or a clearly documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata explicitly states a default of Chinese output, and the workflow content is entirely in Chinese without indicating user choice or a documented locale requirement. This can override user expectations, reduce accessibility, and create opportunities for misunderstanding or misexecution in security-sensitive tasks, though it does not by itself enable direct code execution or data exfiltration.

Content

No source excerpt is available for this finding.