T01 · Skill Instruction Hijacking
Warning
- Location
scripts/summarize.py:31- Finding
Untrusted Remote Metadata Is Embedded in Agent-Consumed Markdown
- Content
View full analysis
- Remediation
View remediation
Security audit
Hfmirror Trending
Security checks for vulnerabilities and agentic risk
Overview
The skill coherently fetches public HF-Mirror trending data and generates a Chinese Markdown report, with manageable caution around untrusted remote text being rendered in that report.
Install only if you want a Chinese HF-Mirror trending report generator. Treat the generated Markdown as untrusted public web data, avoid following links or instructions embedded in model/dataset/Space names, and run it with an explicit output path in a normal workspace.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to perform network access and read/write files by invoking a local script, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization gap: platforms or operators cannot easily constrain the skill to only the minimum required capabilities, increasing the risk of unintended file access, data exfiltration, or network misuse if the script or skill is modified or triggered in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description explicitly says the skill generates '结构化中文 Markdown 报告', which imposes a specific output language. There is no indication that the user can opt into another language or that the Chinese-only behavior is a documented and justified locale constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger conditions are broad and overlap with common requests about popular Hugging Face models, making it easy for the skill to activate unexpectedly during unrelated conversations. Over-broad activation can cause unnecessary network calls and file generation, and in agentic environments it may route user queries through a more privileged workflow than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generated report headings and table labels are fixed in Chinese, which imposes a specific language on all users. This is a natural-language policy concern because the script does not provide any opt-in, configuration, or documented justification for the locale choice.
- Content
Static analysis
No suspicious patterns detected.