T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:13- Finding
Agent Instruction Hijacking Through Embedded Commercial and Payment Directives
- Content
View full analysis
- Remediation
View remediation
Security audit
Ad Copy Gen
Security checks for vulnerabilities and agentic risk
Overview
This skill does not run code, but it embeds off-platform payment prompts and a crypto wallet inside the instructions for an ad-copy tool.
Review this skill carefully before installing. It appears technically low-impact because it is only a Markdown instruction file, but it may cause an agent to surface external payment or contact information while users expect ad-copy help. Do not send money or obtain follow-up files through the listed Telegram, PayPal, or crypto channels unless independently verified outside the skill.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill file is dominated by sales and upgrade messaging rather than operational instructions for using the advertised ad-copy capability. In an agent ecosystem, this is dangerous because the agent may surface unsolicited promotional content, off-platform purchase pitches, or trust-eroding spam instead of performing the declared task, indicating the skill is being used as an advertising vehicle rather than a functional tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation guidance is broad, poorly delimited, and intermixed with sales text, making it unclear when the skill should activate and what behavior is in scope. This can cause accidental triggering, inconsistent behavior, or insertion of promotional content into normal user workflows, increasing misuse risk when agents rely on the documentation to decide tool selection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Direct payment solicitation and off-platform purchase instructions are unrelated to generating ad copy and introduce social-engineering risk. A user or agent following this content could be steered to send money outside trusted platform controls, bypassing marketplace vetting, refunds, auditability, and abuse protections.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Including a cryptocurrency wallet address for payment is especially risky because crypto transfers are irreversible, hard to audit, and commonly used in scams. This has no legitimate operational role in an ad-copy-generation skill and materially increases the chance of financial loss through deceptive prompting or user confusion.
- Content