T01 · Skill Instruction Hijacking
Error
- Location
references/SKILL发布规范.md:8- Finding
Mandatory Commercial Referral Injection into Agent Outputs
- Content
View full analysis
- Remediation
View remediation
Security audit
胡田 OPC导师 Skill发布体系
Security checks for vulnerabilities and agentic risk
Overview
This skill is a commercial skill-publishing toolkit, but it automatically adds OPC referrals and pricing prompts to outputs and generated templates, so users should review it before installing.
Install only if you want an OPC-branded commercialization framework that may add referral blocks, pricing, and follow-up skill suggestions to generated outputs. Review or remove the mandatory referral/footer template rules, require explicit confirmation before loading another skill, and avoid logging raw user identifiers unless you add clear privacy controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (22)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The user-facing documentation is entirely in Chinese, including the title, description, and usage instructions, with no indication that other languages are supported or that Chinese is a region-specific requirement. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly recommends logging user identifiers, timestamps, skill names, and version data for traceability without any minimization, consent, retention limits, access controls, or secure storage guidance. In context, this normalizes collection of identifiable invocation metadata and could enable privacy violations, unauthorized profiling, or leakage if logs are exposed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The follow-up module is configured to trigger after essentially any answered question or completed document, which creates an always-on recommendation surface rather than a narrowly scoped user-initiated action. In a commercialized skill ecosystem, this can be abused to steer users into unintended skill loading, increase prompt injection exposure through chained interactions, or create dark-pattern upsell behavior without clear consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill asks for team background information, which may include personal or sensitive professional data, without any minimization guidance, consent notice, retention policy, or handling restrictions. In a due-diligence context, users may provide resumes, employment history, identity details, or unverifiable allegations, creating privacy and compliance risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill embeds cross-skill routing and paid upsell prompts after producing a due-diligence report, which expands behavior beyond the declared analytical purpose. This can manipulate user workflow, bias recommendations, and create unannounced commercial steering, especially when users may interpret the suggestions as part of an objective technical assessment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase "换一批" is overly broad for a conversational interface and can be said naturally by users outside the recommendation workflow. That can cause unintended recommendation refreshes, resulting in unexpected skill switching or state changes without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Using a bare numeric reply like "1" as a control command is ambiguous in normal chat because users frequently send standalone numbers for unrelated reasons. This can unintentionally load another skill or alter the conversation flow, especially in multi-turn sessions where context may be weak or stale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The interaction rule again treats "换一批" as a global actionable phrase without sufficient contextual constraints. In a skill orchestration environment, that raises the risk of unintended invocation and makes prompt-routing behavior less predictable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and invocation examples are entirely in Chinese and present the skill as a Chinese-language interface, with no indication that other languages are supported or that the user can opt in to this locale. Under the policy rule, a skill that imposes a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
A manifest presented only in Chinese without language choice or user opt-in can prevent users and reviewers from understanding activation scope, pricing, and linked capabilities. That lack of transparency increases the risk of uninformed consent and unintended activation, especially in multilingual environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
These trigger phrases are generic business terms that can easily appear in normal conversation, making accidental activation plausible. When combined with recommendation links, broad triggers can route users into functions they did not request, creating scope creep and possible disclosure or decision-support in inappropriate contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Planning and decision-making language like this is too ambiguous for a manifest-triggered model because it overlaps with many ordinary requests. That ambiguity makes the recommendation engine more likely to activate or promote this skill outside its intended context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The network configuration spans many unrelated domains such as games, philosophy, finance, and self-improvement, which materially exceeds the stated release-system purpose. In a recommendation or trigger-based skill environment, this expands the activation and referral surface, increasing the chance of unintended routing, policy bypass through cross-skill chaining, and user exposure to irrelevant or higher-risk capabilities.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Common content and marketing phrases create a collision risk with everyday requests, so this skill may activate during routine conversation unrelated to the intended workflow. In a multi-skill network, that can amplify unwanted referrals and monetized upsell behavior without clear user consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Broad user-management and marketing triggers are insufficiently specific and may match benign discussion about customers, operations, or growth. That makes unintended activation likely, especially because the file also defines synonym expansion and recommendation weighting that can widen matching behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The text states '提供中文/英文双语description' as a requirement, which imposes a specific language policy in the skill guidance. The file does not present this as optional, user-selected, or narrowly justified beyond platform adaptation, so it can conflict with the rule against forcing a language or locale without opt-in.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest-style example includes a triggers field populated only as "触发场景", which does not define specific phrases, contexts, or boundaries for activation. For a publication规范 document, this can propagate vague trigger design into downstream skills.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The documented workflow promises a complete technical due-diligence report, but later sections introduce service routing and monetized follow-up actions that are not disclosed as part of the main behavior. This mismatch can mislead users about the skill's scope and compromise trust in the neutrality of the report output.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Cognitive and self-improvement phrases are very broad and likely to overlap with normal conversation, so they create imprecise activation boundaries. The direct security impact is lower than finance or operational skills, but they still increase unsolicited routing and reduce user control over which skill is invoked.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Generic team and leadership phrases are too vague to safely drive manifest activation, because they are common in ordinary workplace discussions. While the immediate harm is limited, the broad trigger surface can still cause unintended invocation and chain into governance or organizational advice the user did not request.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The platform compatibility table states that the xiaopeng platform requires '提供中英双语', which imposes a language requirement in the template guidance. This is a natural-language locale policy constraint without any mention of user preference, opt-in, or justification as a region-specific exception.
- Content
Static analysis
No suspicious patterns detected.