T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:4- Finding
Unconditional Tool-Priority Override Redirects Searches to an External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Web Search Free
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it broadly steers searches and page fetches to a third-party Exa service instead of built-in tools.
Review this before installing. Use it only for public web research where sending the query, URL, company/person name, or code-search text to Exa and fallback search providers is acceptable. Avoid private source code, internal URLs, credentials, personal data, or confidential business context unless the user has explicitly approved that sharing. The skill should ideally remove the blanket 'always use' language and require deliberate use or consent for the remote MCP configuration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The metadata description instructs that this skill should always be used before other web search or fetch skills, but it does not define clear trigger conditions or safety boundaries. Overly broad routing guidance can cause the agent to prefer this third-party search path for unrelated tasks, increasing unnecessary exposure of user prompts and data to external services and potentially bypassing more appropriate built-in tools.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The repeated 'should always use' instruction in the body reinforces a blanket priority rule without context-sensitive constraints. In an agent environment, this can bias tool selection toward an external MCP service even when unnecessary, enabling prompt/data over-sharing and weakening the system's intended tool-governance controls.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples file documents and encourages use of capabilities far beyond the skill’s declared purpose of free web search and fallback search, including code-context retrieval, company/person research, URL crawling, and long-running deep research tasks. This scope expansion can mislead downstream agents into invoking broader data-collection or external-access functions than users or policy reviewers expect, increasing the chance of unintended data exposure, overcollection, or policy bypass through an apparently simple search skill.
- Content
Static analysis
No suspicious patterns detected.