T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:155- Finding
Mandatory Advertising and Traffic-Diversion Content in Generated Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Guanrentang Writer
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent article-and-image workflow, but it needs Review because it uses broad auto-triggers, external API calls, and an unsafe `.env` sourcing pattern that can execute local shell code.
Install only if you intend to generate branded Chinese公众号 content for this clinic context. Prefer supplying `ZHIPU_API_KEY` through a trusted environment or secret manager instead of a sourced `.env` file, review every generated article before publishing, confirm before external image generation, and verify any follow or QR-code asset destination yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:292- Finding
Arbitrary Shell Command Execution Through Sourced Environment File
- Content
View full analysis
- Remediation
View remediation
` entry and reject duplicate keys, command substitutions, shell metacharacters, additional assignments, and unexpected lines. 5. Validate the API key against the provider’s documented character set and length constraints. 6. Open the file without following symbolic links where the execution environment supports that protection. 7. Verify that the file is owned by the expected user and is not writable by group or other users. 8. Require restrictive permissions such as owner read/write only. 9. Avoid printing the API key in progress output, logs, command traces, or error messages. 10. Run image generation with the minimum filesystem and network permissions required for the task. A safer conceptual approach is: ```bash if [ -z "${ZHIPU_API_KEY:-}" ]; then printf '%s\n' "ZHIPU_API_KEY must be supplied through the process environment." >&2 exit 1 fi ``` If file-based configuration cannot be removed, it should be parsed by a non-shell configuration library and the extracted value should be passed to the API client without evaluating any part of the file. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (17)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises auto-triggering on broad phrases like '写文章' and '帮我写一篇', which overlap heavily with ordinary user requests. In an agent environment, overly broad activation can cause the wrong skill to run unexpectedly, leading to unintended file creation, API use, and external requests without clear user intent.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 方式 | 命令 | 说明 | |-----|------|------| | **方式一：环境变量** | 在 `~/.zshrc` 或 `~/.bashrc` 中添加 `export ZHIPU_API_KEY=your_key` | 全局可用，适合多个项目 | | **方式二：.env 文件** | 在 skill 目录下创建 `.env` 文件，内容为 `ZHIPU_API_KEY=your_key` | 仅此 skill 使用，已加入 .gitignore | > **执行前检查**：如果未配置 API Key，应提示用户选择上述方式之一配置后再继续
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 方式 | 命令 | 说明 | |-----|------|------| | **方式一：环境变量** | 在 `~/.zshrc` 或 `~/.bashrc` 中添加 `export ZHIPU_API_KEY=your_key` | 全局可用，适合多个项目 | | **方式二：.env 文件** | 在 skill 目录下创建 `.env` 文件，内容为 `ZHIPU_API_KEY=your_key` | 仅此 skill 使用，已加入 .gitignore | > **执行前检查**：如果未配置 API Key，应提示用户选择上述方式之一配置后再继续
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 方式 | 命令 | 说明 | |-----|------|------| | **方式一：环境变量** | 在 `~/.zshrc` 或 `~/.bashrc` 中添加 `export ZHIPU_API_KEY=your_key` | 全局可用，适合多个项目 | | **方式二：.env 文件** | 在 skill 目录下创建 `.env` 文件，内容为 `ZHIPU_API_KEY=your_key` | 仅此 skill 使用，已加入 .gitignore | > **执行前检查**：如果未配置 API Key，应提示用户选择上述方式之一配置后再继续
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The script sources a local .env file directly from the skill directory, causing the agent to ingest credentials from disk into its execution environment. In an agent setting, automatic secret loading increases the chance of unauthorized secret use, especially when combined with external network calls in the same workflow.
- Content
md ARTICLE_TITLE="春季养肝全攻略" # 2. 读取 API Key（优先级：环境变量 > skill 目录 .env） if [ -z "$ZHIPU_API_KEY" ] && [ -f "$SKILL_DIR/.env" ]; then source "$SKILL_DIR/.env" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Checking for and sourcing a .env file in the skill directory implicitly trusts local shell content. Because 'source' executes shell syntax rather than safely parsing key-value pairs, a tampered .env file could inject additional commands or environment manipulation during execution.
- Content
md # 2. 读取 API Key（优先级：环境变量 > skill 目录 .env） if [ -z "$ZHIPU_API_KEY" ] && [ -f "$SKILL_DIR/.env" ]; then source "$SKILL_DIR/.env" fi # 3. 检查 API Key 是否配置
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
The pipeline takes a URL returned by an external service and feeds it directly into a second curl invocation via xargs, with no validation of scheme, host, or content. That creates a chaining/trust-boundary problem: a compromised or unexpected API response could cause arbitrary remote fetches, enabling SSRF-like behavior, retrieval of malicious payloads, or writing attacker-controlled content to disk.
- Content
md -H "Content-Type: application/json" \ -d '{"model":"glm-image","prompt":"中医养生插画，春季养肝疏肝示意图，肝脏与人体气机运行，新中式水墨插画风格，中国传统色（黛青、朱砂、米白），淡雅晕染效果，留白构图，温暖治愈氛围","size":"1472x1088"}' \ | jq -r '.data[0].url' \ | xargs -I {} curl -s -o "${OUTPUT_DIR}/images/${ARTICLE_TITLE}/content-1.jpg" "{}" # 7. 等待 2 秒 sleep 2
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage section reinforces broad trigger behavior without defining scope limits or disambiguation rules. That makes accidental invocation more likely, which is especially risky here because the skill can write files and call an external image API automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instructions require Chinese filenames and throughout the document prescribe Chinese fixed phrases and Chinese-language prompts, but do not explicitly state that the skill is region-specific or provide a user opt-in for language choice. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless the restriction is clearly documented and justified.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建文章和图片目录 mkdir -p "${OUTPUT_DIR}/images/${ARTICLE_TITLE}/" # 复制固定素材到输出目录 cp -r "${SKILL_DIR}/assets" "${OUTPUT_DIR}/"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建文章和图片目录 mkdir -p "${OUTPUT_DIR}/images/${ARTICLE_TITLE}/" # 复制固定素材到输出目录 cp -r "${SKILL_DIR}/assets" "${OUTPUT_DIR}/"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The general Step 3 instructions say articles must include TCM theory, diet therapy, acupoints/precautions, and the fixed closing line. Later, the '放假通知' section explicitly says this theme has no body text, uses a user-provided image, and does not need AI-generated images or ending images. These instructions actively contradict each other for one supported mode of the skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Step 5 states that after saving an article, the skill immediately parses image markers, generates prompts, calls the image API, and downloads each image. But the '放假通知' section later states the body image is user-provided and explicitly says AI image generation is not needed. This is an intent-level contradiction in the documentation of how the skill behaves.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This skill transmits generated prompts and authentication material to an external API endpoint. In context, external transmission is part of intended functionality, but it still creates privacy and data-governance risk because article content or user-supplied material may be sent off-platform without a dedicated consent gate.
- Content
bash # 1. 调用 API 生成图片 RESPONSE=$(curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/images/generations" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The example workflow again sends content to an external image-generation service and then retrieves remote content for local storage. While expected for the feature, this expands trust to a third party and can expose sensitive prompts or create supply-chain style risk from blindly fetching returned URLs.
- Content
md cp -r "$SKILL_DIR/assets" "${OUTPUT_DIR}/" # 6. 生成第一张配图（示例：春季养肝示意图） curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/images/generations" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model":"glm-image","prompt":"中医养生插画，春季养肝疏肝示意图，肝脏与人体气机运行，新中式水墨插画风格，中国传统色（黛青、朱砂、米白），淡雅晕染效果，留白构图，温暖治愈氛围","size":"1472x1088"}' \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill hard-codes Chinese-language output and a specific house style without indicating any user language preference check or opt-in. This can override user intent, reduce transparency, and cause the agent to respond in an unexpected language, which is a genuine policy/quality risk though not a classic security exploit.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The generic article-writing section requires the fixed closing line '您点的每个赞，我都认真当成了喜欢'. Later, the '古法熏蒸' fixed-theme instructions explicitly say that article type should not use that line and should end with a promotion sentence instead. This is a direct contradiction between two documented behaviors.
- Content
Static analysis
No suspicious patterns detected.