T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:16- Finding
Mandatory Loading of Untrusted External Instructions with Asserted Priority
- Content
View full analysis
- Remediation
View remediation
Security audit
gate-info-addresstracker
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a read-only blockchain address analysis skill, but it requires unaudited parent-directory rule files with asserted priority and can automatically broaden address checks into deeper tracing.
Review before installing. The blockchain analysis itself is read-only and aligned with the skill's purpose, but users should be aware that it depends on rule files outside the package review and may perform deeper tracing automatically. Prefer a version that packages all required runtime rules, keeps tool declarations consistent, and asks before escalating from basic address lookup to fund-flow tracing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata advertises only three MCP tools, but the body later instructs use of
info_onchain_get_transactionas a direct action path. That mismatch can cause enforcement or auditing layers to believe the skill has a narrower capability set than it actually uses, enabling undeclared tool invocation and weakening tool-allowlist controls.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description says to use this skill whenever the user provides an on-chain address or asks to track/query an address, which is broad enough to activate on incidental address mentions. In a surveillance-oriented skill, overbroad activation can unnecessarily collect and analyze blockchain activity beyond the user's actual request, expanding privacy impact and tool usage.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## General Rules ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `../gate-runtime-rules.md` → Also read `../info-news-runtime-rules.md` for gate-info / gate-news shared rules (tool degradation, report standards, security, routing, and optional local maintenance when `scripts/` is present). - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to call only documented tools, but the documentation is internally inconsistent because the manifest exposes a narrower set than the body uses. This creates a policy gap where an agent may legitimately follow one section while violating another, undermining reliable tool-scope enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Deep-tracking routing keywords like 'track' and 'fund flow' are ambiguous and can overlap with ordinary conversation. That can push the skill into a more invasive analysis mode than intended, increasing data retrieval and behavioral inference without clear user authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to automatically escalate from basic identity lookup to deeper transaction history and fund-flow tracing based on internal heuristics such as labels, balance, or risk flags, even when the user did not request that level of analysis. This can expand data collection and potentially expose sensitive financial behavior without clear user awareness or consent, which is a privacy and scope-control issue in an on-chain intelligence context.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The automatic upgrade to deep mode based on labels, balance, or risk flags broadens the action scope from a simple profile request to transaction history and fund-flow tracing without a fresh user-intent check. In this context, that increases privacy and surveillance impact and may violate the principle of least astonishment, though it remains read-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file includes a scenario explicitly scoped to 'Chain specified (English)', which indicates a language-specific constraint in the skill documentation. There is no accompanying note that other languages are supported, optional, or intentionally limited for a justified regional/compliance reason.
- Content
Static analysis
No suspicious patterns detected.