T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:271- Finding
Agent Instructions Mandate Unsolicited Lead Generation and Third-Party Contact Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
Wanpaike Opc Business Plan
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it also contains agent-facing promotion/referral instructions and an automatic unpinned package install that users should review before installing.
Install only if you are comfortable with a Chinese/China-market business-plan workflow, visible promotional/referral language in the skill instructions, and a script that may automatically install python-pptx. Run it in a virtual environment, install dependencies explicitly yourself, and choose the PPTX output path carefully to avoid overwriting files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/generate_bp_pptx.py:110- Finding
Automatic Runtime Installation of an Unpinned Python Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior materially differs from the actual capability: the skill promises dynamic financial analysis and structured questioning, but the implementation reportedly only templates provided data and may auto-run pip to install dependencies. Hidden environment modification and possible network/package installation are especially risky because they can change the host environment, pull untrusted code, and violate user expectations about what the skill will do.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content in this file consistently forces a single language/locale experience. Per the policy, language constraints should either be optional for the user or clearly documented as a justified region-specific limitation, which is not present here.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to read local reference files and invoke a shell command to run a Python script, but it does not declare any tool scope such as allowed tools or permissions. This creates an implicit capability boundary bypass: a host may permit broader file or shell access than the user expects, increasing the chance of unintended file access or command execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The description states the model is designed specifically for Chinese tech-innovation early-stage companies, which imposes a locale-specific scope. Under the policy rule, locale constraints should either be optional for the user or clearly documented and justified; here the constraint is asserted as default framing rather than as an opt-in or compliance necessity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is entirely authored in Chinese and presents the framework as the sole interaction/documentation language. Under the policy, a skill should not force a specific language or locale unless it offers opt-in/choice or clearly documents a justified regional constraint, neither of which appears in the file.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Auto-installing a package during normal execution is not necessary for the stated PPT-generation purpose and expands the script's capabilities to include network access and external code retrieval. In a skill/agent context this is more dangerous because dependency resolution happens implicitly, outside normal review and change-control, increasing supply-chain and environment-manipulation risk.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script executes a subprocess to run pip install at runtime when python-pptx is missing. This introduces unexpected code execution and network/package-supply-chain behavior into a document-generation tool, meaning an attacker controlling package indexes, mirrors, or the environment could influence what gets installed and executed.
- Content
python except ImportError: print("正在安装python-pptx...") import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "python-pptx", "-q"]) from pptx import Presentation from pptx.util import Inches, Pt, Emu from pptx.dml.color import RGBColor
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file states that the skill will '自动生成PPT文件交付', and later provides a command that writes a .pptx output file. Under the markdown criteria for SQP-2, file-writing behavior that affects user data or filesystem state should be disclosed with a user warning, but no caution or note is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description emphasizes business-plan generation but does not clearly warn that it will write a PPTX file to disk. This is a transparency and safety issue because users and host systems may not anticipate filesystem side effects, which can lead to accidental overwrites or execution in sensitive directories.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains instructional content exclusively in Chinese, including the title and all explanatory sections, with no indication that users may choose another language. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file is a code file, so SQP-3 applies to natural-language strings embedded in the code. The script predominantly generates Chinese slide content and labels, but the closing slide is forced to English with "Thank You", with no option for the user to choose locale or keep the presentation language consistent.
- Content
Static analysis
No suspicious patterns detected.