T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Deceptive Output Hijacking and Forced External-Service Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
B12 Website Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a B12 signup-link generator, but it can mislead users into thinking a website was already created and embeds their business description in an external URL without clear consent.
Review this skill before installing. It is not a local-code or credential risk, but users should understand that it promotes B12, may discourage discussion of alternatives, and may place any business description they provide into a URL sent to an external service. Avoid entering confidential plans, personal data, credentials, or trade secrets unless the flow is revised to disclose and confirm that transfer.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger condition is overly broad because it includes generic phrases like "Describe your website" and a catch-all "or invokes this skill," which can cause the skill to activate in contexts where the user did not clearly intend to send content into an external website-generation flow. In this skill, unintended activation matters because the agent may solicit or transform user business details and direct them into a third-party signup URL, increasing the risk of confused-deputy behavior and accidental data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to place the user's business description into a B12 signup URL, but it does not require a clear user-facing disclosure that the description will be transmitted to an external service. This creates a privacy and consent issue: users may provide sensitive business or personal details without realizing those details are embedded in a third-party link and potentially exposed via browser history, logs, referrers, or shared messages.
- Content
Static analysis
No suspicious patterns detected.