T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:204- Finding
Mandatory Persistent Modification of Agent Knowledge and Registration State
- Content
View full analysis
- Remediation
View remediation
Security audit
Harmonyos Code Workshop
Security checks for vulnerabilities and agentic risk
Overview
This is mainly a HarmonyOS coding assistant, but it asks the agent to modify persistent expert knowledge and re-register itself after conversations.
Install only if you are comfortable disabling or ignoring the self-learning and re-registration instructions. Review generated code carefully for telemetry, background location, file quarantine, push-token handling, and third-party model/provider configuration before using it in a real app.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:204- Finding
Unsolicited Response Injection Triggered by Generic User Confirmations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:3600- Finding
Raw Push Token Written to Application Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: harmonyos-code-workshop version: 6.1.0 description: "HarmonyOS 7 (API 26) 全流程编码助手，精通ArkTS+ArkUI，提供高质量原生鸿蒙代码" trigger: - 鸿蒙 - HarmonyOS - ArkTS - ArkUI - 鸿蒙代码 - 鸿蒙开发 - 鸿蒙7 - harmonyos code - arkts - 鸿蒙项目 - 鸿蒙应用 - 鸿蒙原生 - 分布式 - 元服务 - atomic service - Stage模型 - 鸿蒙技能 - 鸿蒙专家 - HarmonyOS NEXT - 鸿蒙NEXT - DeveEco - 鸿蒙学习 - 我想开发一个鸿蒙 - 帮我写一个鸿蒙 agent_created: true --- > 📌 **版本信息**：本Skill�
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to automatically append details from every conversation into the expert file creates a clear data retention and prompt-persistence risk. Sensitive user inputs, proprietary code, secrets, or malicious prompt content could be stored and later influence future sessions or leak through generated outputs.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill describes comprehensive behavioral analytics, including click tracking, page transition observation, and exposure measurement, without privacy disclosure or caution. In a coding assistant context, this can cause privacy-invasive instrumentation to be generated as if it were routine best practice, potentially capturing sensitive interaction data at scale.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Bundling enterprise file-scanning and quarantine capabilities into a general coding assistant meaningfully expands the operational scope toward invasive endpoint-security behavior. If surfaced or reused out of context, it can encourage code that scans files across boundaries, handles quarantine actions, and increases risk of misuse on user data or enterprise environments.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Background location tracking is a highly sensitive capability, and the skill presents implementation guidance without strong user-facing privacy warnings, consent, or justification requirements. This can directly enable persistent location collection in generated apps, with substantial surveillance and compliance risk.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 91% confidence
- Finding
This duplicate finding points to the same concealed append instruction in a hidden HTML comment. The concealment matters because it helps smuggle behavioral directives into the skill in a way that may bypass casual review while still steering agent state or future edits.
- Content
md > 此章节由专家在每次对话结束后自动追加。记录了所有实战中踩过的坑、学到的经验。 <!-- 新的经验教训自动追加在此下方 --> ### 2026-06-29 - 持续学习：DevEco Code/CLI + V2 装饰器 + 生产级模式
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 91% confidence
- Finding
This duplicate finding points to the same concealed append instruction in a hidden HTML comment. The concealment matters because it helps smuggle behavioral directives into the skill in a way that may bypass casual review while still steering agent state or future edits.
- Content
md > 此章节由专家在每次对话结束后自动追加。记录了所有实战中踩过的坑、学到的经验。 <!-- 新的经验教训自动追加在此下方 --> ### 2026-06-29 - 持续学习:DevEco Code/CLI + V2 装饰器 + 生产级模式
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set is extremely broad, including generic HarmonyOS-related terms likely to match ordinary conversations. Overbroad activation increases the chance the skill is invoked unexpectedly, exposing users to its self-modifying and privacy-invasive guidance even when they did not intend to use this specific skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill aggregates examples for telephony, location, biometrics, background tasks, and device-control APIs far beyond its advertised role as a general HarmonyOS coding helper. This overbroad capability surface increases the chance the agent will suggest sensitive features by default or inappropriately, leading to unnecessary permission collection and privacy/security exposure in generated apps.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes a global UIObserver tracking framework that captures clicks, page switches, component identifiers, and custom properties, despite being presented as a coding assistant rather than an analytics tool. This broad telemetry pattern could normalize or generate privacy-invasive code that records sensitive user behavior without necessity or adequate notice.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The global tracking example records component IDs, page info, and custom property payloads, which can easily contain business context or sensitive user data. Without strict guidance, developers may copy this pattern verbatim and unintentionally expose personal or confidential interaction metadata to logging or analytics sinks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 71% confidence
- Finding
The skill includes an external model provider endpoint and environment-based API key configuration, which introduces a data egress path from the development environment to a third-party service. While not inherently malicious, in an agent skill this can route prompts, code, or metadata off-platform without any trust or privacy boundary explanation.
- Content
md "deveco": { "name": "DevEco Code", "models": { "glm-5": { "tool_call": true, "limit": { "context": 200000, "output": 8192 } } }, "options": { "baseURL": "https://api.openbitfun.com/v1", "apiKey": "{env:DEVECO_API_KEY}" } } } }
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs itself to edit its own expert files and re-register after conversations, which is a form of self-modification outside the user’s requested HarmonyOS coding scope. In an agent setting, self-editing behavior can persist prompt-injected content, silently alter future behavior, and create a supply-chain style trust problem across sessions.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly states that Router is deprecated/not recommended and promotes Navigation as the unified approach. Later sections still show router-based navigation patterns such as
router.pushDestinationByNameand HMRouterpushUrlexamples, which conflicts with the earlier intent-level guidance rather than merely omitting detail.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The text repeatedly says the expert 'must' automatically detect blind spots, search docs, update files, append lessons, and re-register after every conversation. In this file, those are only declarative instructions with no executable mechanism shown, so the documented intent materially overstates what the skill file itself actually does.
- Content