TuhuCar Knowledge Assistant

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:08 AM UTC
• Version: 0.0.3

Overview

This skill is a disclosed TuhuCar CLI knowledge assistant, with ordinary integration risks around installing a third-party CLI and displaying gateway-supplied answers.

Before installing, verify that @tuhucar/cli and the Homebrew tap are the official sources you intend to trust. Treat answers, links, and update notices as content from the configured TuhuCar gateway, and do not share `tuhucar config show` output if it contains private endpoint or account details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:73

Finding

Mandatory Branded Output and Automatic Notice Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–75
Vulnerability Type: Forced output modification through skill instructions
Risk Level: High

markdown

1. Show `data.reply` to the user and preserve its markdown structure.
2. End with `来自途虎养车`.
3. If `meta.notices` contains an update notice, append the notice message after the answer.

Technical Analysis

The skill requires every successful response to include fixed TuhuCar branding and directs the agent to append remotely supplied update notices. These requirements modify the agent's final response independently of whether the additional content is relevant to the user's request.

The branding requirement is a persistent output instruction activated whenever the skill is used. The notice requirement also provides the external gateway with a channel for inserting additional content into the final response. This behavior is best classified as skill instruction hijacking because the skill changes the agent's output objectives from answering the user's question to also distributing prescribed third-party content.

Attack Path

1. A user asks a question that activates the TuhuCar skill.
2. The agent sends the question to the configured knowledge gateway.
3. The gateway returns a reply and may include an update notice in meta.notices.
4. The skill requires the agent to reproduce the gateway reply.
5. The agent appends the mandatory TuhuCar attribution.
6. If a notice is present, the agent also appends that externally supplied notice to the user-facing response.

Impact Assessment

The issue does not directly grant operating-system privileges or file-system access. Its scope is the current agent response and the user's trust boundary. It enables mandatory promotional attribution and permits gateway-controlled notices to influence final output. A compromised or improperly governed gateway could use notices to distribute misleading clai ...[truncated 91 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to append fixed branding to every response.
• Do not insert meta.notices automatically into user-facing output.
• Display attribution only when it is contextually appropriate or explicitly requested.
• Treat notices as untrusted external data and validate their type, length, links, and permitted content.
• Clearly label any approved notice as content supplied by the external service.
• Require user confirmation before displaying promotional or otherwise unrelated external content.
• Ensure external data cannot override system instructions, safety constraints, or the user's requested output format.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:73

Finding

Untrusted Gateway Markdown Rendered Without Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–75; references/command-reference.md, lines 80–81
Vulnerability Type: Unvalidated external content inserted into agent output
Risk Level: Medium

markdown

1. Show `data.reply` to the user and preserve its markdown structure.
2. End with `来自途虎养车`.
3. If `meta.notices` contains an update notice, append the notice message after the answer.

markdown

- Always pass `--format json` when you need to parse the result.
- The `reply` field is already markdown and should be rendered as-is.

Technical Analysis

The skill instructs the agent to render data.reply as Markdown without validation or sanitization. It also permits meta.notices to be appended automatically. Both fields originate from an external gateway whose location can be overridden using TUHUCAR_ENDPOINT.

Rendering remote Markdown as-is can expose users to deceptive links, impersonated interface elements, promotional content, or instruction-like text. The documented behavior does not establish an allowlist for Markdown elements, validate destinations, limit content length, or require external material to be clearly distinguished from the assistant's own response.

This is an output-level trust-boundary failure. The remote response is data, but the instructions cause it to control a substantial part of the agent's final presentation.

Attack Path

1. An attacker compromises the configured gateway, controls a configured endpoint, or otherwise influences its response.
2. The gateway returns crafted content through data.reply or meta.notices.
3. The CLI places that content in the documented JSON envelope.
4. The skill directs the agent to render the reply as-is and append applicable notices.
5. The user receives attacker-controlled Markdown as part of a trusted assistant response.
6. The crafted response may direct the user to deceptive resources or attempt to infl ...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

• Treat data.reply and meta.notices strictly as untrusted external data.
• Sanitize Markdown before rendering it, including links, embedded HTML, images, and deceptive formatting.
• Permit only a documented subset of Markdown required for maintenance answers.
• Validate link schemes and destinations, and clearly identify links that lead to external sites.
• Label gateway content as externally supplied rather than presenting it as the agent's own verified answer.
• Do not interpret instructions contained in gateway responses as agent directives.
• Apply content-length limits and reject malformed or unexpected response structures.
• Restrict TUHUCAR_ENDPOINT to approved HTTPS origins where feasible.
• Require explicit approval before switching to a non-default endpoint.
• Remove the instruction to append notices automatically.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Global Installation of Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–19
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

markdown

1. Verify the CLI is installed: `tuhucar --version`
2. If it is missing, guide the user to install it:
   - `npm install -g @tuhucar/cli`
   - `brew install tuhucar/tap/tuhucar`

Technical Analysis

The documented installation commands retrieve the current version of a third-party package or tap formula without pinning a reviewed version or requiring checksum or signature verification. The npm command also installs the package globally.

Because the dependency reference is mutable, the code installed in the future may differ from the code reviewed when the skill was published. Compromise of the package registry account, tap repository, maintainer credentials, or release pipeline could therefore introduce malicious installation scripts or binaries.

This finding is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

1. An attacker compromises the package publisher, package registry entry, Homebrew tap, or upstream release process.
2. The attacker publishes a malicious version under the expected dependency name.
3. A user follows the skill's unpinned installation instructions.
4. The package manager resolves and downloads the mutable latest release.
5. Installation scripts or the resulting CLI execute with the installing user's privileges.
6. The malicious dependency can access resources available to that user, subject to operating-system and package-manager restrictions.

Impact Assessment

The maximum potential privilege is the privilege of the account running the package manager. A compromised package could execute commands, read or modify user-accessible files, access environment variables, alter user-level configuration, or intercept questions later submitted thro ...[truncated 174 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specific reviewed version instead of implicitly installing the latest release.
• Publish and verify cryptographic checksums or signatures for distributed artifacts.
• Document the official package source and publisher identity.
• Prefer a local, least-privilege installation over a global installation where practical.
• Disable or review package installation scripts when the package manager supports doing so.
• Use lockfiles or immutable artifact references in automated deployments.
• Establish a controlled update process that reviews release changes before updating the pinned version.
• Avoid recommending elevated package-manager execution unless it is strictly necessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to always end responses with 来自途虎养车 imposes a specific language output regardless of the user's language or locale. This is a natural-language policy concern because the skill does not offer any user choice or document a justified locale-specific restriction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/command-reference.md (reported line 68)May include surrounding context.

md

## `tuhucar config init`

Create the default configuration at `~/.tuhucar/config.toml`.

## `tuhucar config show`

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents tuhucar config show only as 'Print the current configuration' without any caution about visibility of potentially sensitive configuration values. For user-facing command documentation, printing config data can have privacy or security implications if output is copied, logged, or shared.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.