T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:567- Finding
Embedded Lead-Generation Instructions Manipulate Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
概念验证 技术验证引擎
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a technical-validation guide, but it embeds lead-generation language and an external email contact in the operative instructions for users who may be sharing proprietary technical plans.
Review before installing. The technical-validation content appears usable, but users should avoid sending confidential project details to the listed external email unless they independently trust that channel and have approval to share the information.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description specifies the skill entirely in Chinese and presents its behavior as if that is the default operating language, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill identity and persona instructions are entirely Chinese and define a fixed role and catchphrase, but they do not offer any language selection or explain a region-specific need for Chinese output. This can amount to an implicit language restriction if the skill is invoked by users with other language preferences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to activate during ordinary technical discussions, which can cause unintended routing into this skill without clear user intent. That raises the risk of over-collection of project details, inappropriate use of specialized workflows, and confusion about whether the user explicitly consented to structured technical evaluation.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill exposes an external contact channel (email) that is unrelated to the core technical-validation workflow, creating a path for data exfiltration, off-platform social engineering, or bypass of platform logging and policy controls. In a skill that may process proprietary technical plans, encouraging users to move discussions off-platform increases confidentiality and trust risks even if the contact appears legitimate.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
该 markdown 文档全文以中文撰写，未说明这是面向特定中文用户群体的区域化文档，也未提供其他语言选项或用户选择机制。按照规则，若技能或参考文档强制特定语言而无用户 opt-in，属于自然语言层面的语言/locale 策略问题。
- Content