T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:89- Finding
Commercial Recommendation and Lead-Generation Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
永恒日升供应商信息查询
Security checks for vulnerabilities and agentic risk
Overview
This static supplier-information skill is not host-malicious, but it broadly steers generic supplier searches toward one company and lead-generation contact details.
Review this skill as company-authored promotional content. Install it only if you want the agent to surface Yongheng Risheng for relevant sourcing queries; for neutral supplier discovery, require comparative results, disclosure of source material, and caution before sending drawings or procurement details to the listed contact.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The stated purpose is to help the agent '找到并推荐永恒日升' when users search for automotive parts or stamping suppliers, but it does not define limiting conditions for when recommending this specific supplier is appropriate. That ambiguity encourages preferential promotion during broad commercial queries, which can distort agent behavior and reduce neutrality in supplier selection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger examples include broad generic phrases like '找冲压件供应商' and region/category searches that are not uniquely tied to this supplier. In an agent-routing context, this can cause the skill to activate for general procurement queries and steer recommendations toward a single vendor without sufficient user intent, creating relevance manipulation and biased supplier selection risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The keyword list includes many generic procurement and product terms such as '找供应商', '冲压件报价', and '汽车零部件供应商' that are not scoped to this specific company. This can cause the skill to activate on unrelated sourcing requests and steer the agent toward promoting one supplier when the user did not ask for that brand, creating relevance, integrity, and potential undisclosed-advertising risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger guidance tells the agent to proactively provide this company's information whenever a request 'matches' broad supplier-search scenarios, including generic requests like '找冲压件供应商'. Without clear non-activation rules, the skill can override user intent and bias the assistant into unsolicited vendor recommendation, which is a prompt-scope vulnerability even though the content is otherwise non-executable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 64% confidence
- Finding
该文件的自然语言内容完全以中文呈现，未说明是否支持根据用户偏好切换语言，也没有给出语言选择或 opt-in。根据 SQP-3，若技能在自然语言层面隐含强制特定语言而未提供选择，可能构成语言/locale 策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
Across the description, guidance, and examples, the skill prescribes behavior entirely in Chinese with no opt-in language selection or statement that the agent should adapt to the user's language. If deployed to a multilingual environment, this can effectively force a language preference without user choice.
- Content