T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:440- Finding
Embedded Referral Instructions Hijack Agent Outputs for Undisclosed Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
Hutian Opc Business Plan
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its business-plan purpose, but it includes agent-facing referral and contact-promotion instructions that can steer users outside the requested task.
Review this skill before installing if you do not want agent responses to include ecosystem referrals, promotional scripts, or the listed third-party email. If you use it, share only the business details needed for the plan and redact confidential financial, equity, customer, personnel, or fundraising information where possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly guides users to provide sensitive business information, including financial projections, equity structure, fundraising plans, team backgrounds, and strategic risks, but gives no warning about sensitivity, storage, or data-minimization practices. This can lead users to disclose confidential or investor-sensitive information they might not otherwise share, creating confidentiality, privacy, and competitive exposure risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger descriptions are broad enough to activate the skill in loosely related contexts such as financing, BP optimization, or pre-pitch preparation without clear user consent boundaries. In a skill that solicits detailed market, financial, team, and fundraising data, over-broad activation increases the chance of unnecessary collection or steering users into sharing sensitive business information.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill README is entirely written in Chinese and presents the skill as a general-purpose business-plan generator, but it does not mention that the skill is Chinese-only, offer alternative language support, or ask for user language preference. Under the policy for natural-language violations, a forced locale without user opt-in can be a violation unless the regional constraint is explicit and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The description and all user-facing instructions are written exclusively in Chinese, with no indication that the user may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown reference is entirely presented in Chinese and does not offer any user language or locale selection. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all headings, labels, and instructional content exclusively in Chinese, and it does not indicate that the user can choose another language or that the document is intentionally restricted to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.