T01 · Skill Instruction Hijacking
Error
- Location
scripts/startup_os_db.py:545- Finding
Unsolicited Commercial Content Injected into Local Daily Brief Results
- Content
View full analysis
- Remediation
View remediation
Security audit
bossskill
Security checks for vulnerabilities and agentic risk
Overview
This is a mostly coherent business-assistant skill, but it needs Review because it can send business text plus license and device identifiers to cloud services and stores a reusable license key locally.
Before installing, treat this as a cloud-connected business-record system, not just a local coaching prompt. Use it only if you are comfortable with license/device identifiers and current licensed-command inputs being sent to the vendor cloud, avoid entering unnecessary personal or confidential business data, keep the SQLite database and exports protected, and do not rely on BOOSKILL_CORE_MODE=local as a no-network guarantee without a code fix.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/startup_os_db.py:684- Finding
Configured Local-Only Mode Does Not Prevent Cloud Transmission
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/booskill_license.py:80- Finding
Reusable License Key Stored in Plaintext Cache File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (44)
Tainted flow: 'request' from os.environ.get (line 123, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The request URL is derived from environment-controlled server settings, so anyone who can influence BOOSKILL_LICENSE_SERVER or BOOSKILL_CORE_SERVER can redirect license or core traffic to an attacker-controlled endpoint. That causes outbound transmission of the license key, machine fingerprint, and command metadata, creating SSRF-style abuse and credential/data exfiltration risk.
- Content
python headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(request, timeout=12) as response: return json.loads(response.read().decode("utf-8"))
Tainted flow: 'request' from os.environ.get (line 123, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
Cloud-core requests are also sent to an environment-configurable endpoint, allowing redirection of command payloads, license keys, and machine identifiers to an attacker-controlled server. In the context of a coaching workflow, this is more concerning because user-entered business/customer text may be included in args and silently leave the local environment.
- Content
python headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(request, timeout=60) as response: return json.loads(response.read().decode("utf-8"))
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## 授权码协议确认 用户购买、领取、发送、输入、提交、激活或使用 BossSkill 授权码，即表示已阅读、理解并同意 `USER_AGREEMENT.md`、`PRIVACY.md` 和 `LICENSE_NOTICE.md`。
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is business coaching, but the skill also describes license activation, device identification, cloud command routing, cache storage, and remote communication. This mismatch undermines informed consent: users may invoke what թվում like a local advisory skill while triggering remote data flows and authorization mechanisms not clearly reflected in the primary description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The client package includes license verification that transmits an authorization code, device identifier, and feature name, which is unrelated to the core coaching workflow and creates user/device tracking capability. This can expose sensitive metadata, enable fingerprinting, and violate least-privilege and data-minimization expectations if not prominently disclosed and controlled.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The release notes explicitly describe sending commercial commands to a remote cloud-core endpoint, which extends behavior beyond a local coaching/secretary workflow and introduces external data-flow risk. Even though the document says only command parameters are sent by default, the feature creates a remote execution and data exfiltration pathway that may be under-disclosed relative to the skill’s stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file is entirely written in Chinese and the recommended prompt instructs the assistant how to answer老板问题, but it does not offer any language or locale choice for users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README shows the skill being activated by plain conversational phrases such as customer notes, team observations, and task prompts without defining strict command boundaries or requiring explicit confirmation before state-changing actions. In an agent platform, this can cause accidental triggering from normal chat content, quoted text, forwarded messages, or prompt-injected context, leading to unintended data creation, follow-up actions, or cloud requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase '今晚追结果' / 'Review unfinished tasks tonight' is a broad natural-language trigger that appears to initiate workflow behavior without specifying scope, target set, or confirmation. In a multi-turn agent environment, such underspecified triggers can be invoked unintentionally or through injected/quoted text, causing unwanted task review, status prompts, or autonomous follow-up behavior against the user's stored business data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool scope or allowed-tools boundary while the content instructs use of local scripts, database access, file operations, and network-backed licensing flows. That creates a permission ambiguity where a host may grant broader capabilities than users expect, increasing the chance of unauthorized file, environment, or network access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language instructions, examples, and required outputs are all framed in Chinese, and the skill does not state that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a locale-policy violation unless the constraint is clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Using broad trigger phrases such as '保存' and '查一下' as direct tool-invocation signals can cause unintended execution of local commands from ordinary conversation. In a secretary-style skill handling business records, ambiguous triggers raise the risk of unauthorized reads/writes to customer, employee, task, or contact data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The phrase '今天有哪些' is vague and can naturally occur in normal planning conversation, yet the skill treats it as a tool trigger in some contexts. That ambiguity can lead to unnecessary database reads or workflow execution when the user only wanted generic planning advice, exposing recorded operational data more often than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file contains natural-language policy-relevant content, and the entire user agreement is written in Chinese with no indication that users may select another language or that the skill is limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The default prompt is a very broad activation phrase that can trigger open-ended business coaching behavior without clearly constraining allowed topics, boundaries, or refusal conditions. In an agent setting, this increases the risk of prompt abuse, overscoped assistance, or the model being steered into sensitive operational, legal, HR, or financial guidance beyond the intended coaching use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The recommended bootstrap prompt is entirely in Chinese and directs the assistant’s default interaction style without any indication that the user has opted into Chinese. This can override user expectations, reduce transparency, and make safety notices or consent-sensitive actions less understandable for non-Chinese-speaking users, especially in a skill that may handle customer, team, and business records.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The startup instruction is written as a directive that constrains the assistant's behavior and includes fixed Chinese-language phrasing for how it should respond. In this manifest there is no indication that users may choose another language or that the Chinese-only behavior is limited to a justified region-specific context, which makes it a language/locale policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The document instructs users to export the SQLite database to JSON and sync it to other systems, but it does not warn that the database may contain customer, team, and business-operational data. In this skill’s context, that omission can lead users to move sensitive data into less protected locations or third-party memory systems without considering confidentiality, retention, or access controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is broad enough to trigger on generic requests like asking what to do next or wanting reminders, which can cause the skill to activate outside its intended business-coaching scope. Over-broad routing increases the chance of unintended data handling, irrelevant workflow insertion, or overshadowing more appropriate skills in ordinary conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The mandated output template is entirely in Chinese without any stated locale requirement or user-language negotiation. This can cause responses in the wrong language, degrade usability, and create confusion in task or reminder workflows, especially if deadlines, owners, or acceptance criteria are misunderstood.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document defines structured storage for extensive employee and customer personal data, including phone numbers, social accounts, family relationships, compensation structure, performance scores, and sensitive behavioral notes. Although it includes a brief note to ask permission for sensitive customer data, it lacks clear data minimization, retention, access control, lawful basis, and handling guidance for employee/customer PII, making it easy for downstream agents or operators to over-collect and persist sensitive information in memory or knowledge stores.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes startup coaching, secretary workflows, follow-up, team management, task review, and business diagnosis, but this file derives a machine identifier from host characteristics and uses it for remote license activation/checking. Commercial licensing controls may be operationally useful, but they are not a direct or obvious requirement of the stated end-user coaching functionality.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description focuses on founder coaching, customer follow-up, team management, task review, diagnosis, and checklists, while this code primarily implements network calls to external license and core servers. Those remote control-plane operations are not reflected in the manifest description and go beyond an obvious implementation detail for a coaching skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code transmits a license key and machine identifier to remote services without any user-facing notice in this file, and cloud-core execution may also send command metadata and user-provided content. In a business coaching context, undisclosed outbound transfer increases privacy and compliance risk, especially where business/customer data may be involved.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The printed license-required message is hard-coded in Chinese, which imposes a specific language on all users without any opt-in or locale selection. The policy forbids forced language or locale behavior unless the skill offers a choice or clearly documents a justified regional constraint.
- Content