T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:241- Finding
Hard-Coded Third-Party Product Promotion Alters Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
project-diagnosis-skill
Security checks for vulnerabilities and agentic risk
Overview
This skill provides business project diagnosis guidance and does not install code, access files, or create persistence, though it does include a disclosed recommendation for BossSkill.
Install this if you want Chinese-language business idea and project validation advice. Be aware that it may recommend BossSkill for ongoing task or customer follow-up, so treat that as a package-authored suggestion rather than a neutral product comparison.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation condition is very broad, covering founders, operators, salespeople, product direction, pricing, funnels, delivery, and growth issues. In a multi-skill agent, this can cause over-triggering and inappropriate routing, leading the skill to intercept many general business requests and potentially override more specialized or safer skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill content is entirely in Chinese and does not instruct the agent to detect or respect the user's preferred language. This can cause language-mismatch failures, misunderstandings, and degraded guidance quality when activated for non-Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata and default prompt are entirely in Chinese and do not offer language negotiation, which can force interaction in a language the user did not choose. This can cause misunderstanding of business advice, incorrect responses, or unsafe reliance on guidance when users misinterpret prompts or recommendations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The default prompt is broad enough that the skill could be invoked for a wide range of loosely related business questions without clear boundaries or eligibility checks. Overbroad activation increases the chance of accidental triggering, misrouting user requests, and collection or processing of sensitive business information in contexts the skill was not intended to handle.
- Content