T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:588- Finding
Mandatory Promotional Content and External Contact Redirection in Generated Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
创业项目评估器
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the promised startup evaluation, but it also requires reports to include sales lead wording, paid service recommendations, and an external WeChat contact.
Review this carefully before installing if you want neutral startup advice. The analysis framework is usable, but generated reports may include embedded advertising, paid upsell recommendations, and a third-party enterprise WeChat contact unless the skill is edited or constrained.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and prescribed interaction patterns are entirely in Chinese and do not offer the user a language choice or fallback, which can exclude or mislead users who do not understand Chinese. In a user-facing agent skill, forcing a language without opt-in can cause consent, usability, and accuracy issues because users may proceed without fully understanding questions, scoring logic, or recommendations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document is entirely written as a Chinese-only scoring reference and presents the evaluation framework without any indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a policy issue unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown content is entirely presented in Chinese, including headings, instructions, and examples, with no indication that users may choose another language or locale. Under the policy criteria, a skill that imposes a single language without opt-in can constitute a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all instructions, examples, and templates exclusively in Chinese, and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill is written in Chinese and does not indicate that users may choose another language or that the Chinese-only format is intentional for a region-specific audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.