T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/kr36_fetch.py:10- Finding
Static Mock Data Is Presented as Current 36kr News
- Content
View full analysis
- Remediation
View remediation
Security audit
36kr Hot Cn
Security checks for vulnerabilities and agentic risk
Overview
This skill is low-privilege, but it advertises current 36kr news while returning hardcoded mock headlines as if they were real results.
Review before installing if you expect live news. The skill does not appear to endanger the local system, but its output should be treated as demo/mock data unless the publisher replaces the hardcoded headlines with verified 36kr retrieval and clearly labels any simulation mode.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad terms like '科技新闻' and '创业', which are common conversational topics and can cause the skill to activate outside clear user intent for this specific source. This creates routing ambiguity and prompt-scope confusion, increasing the chance the agent invokes the skill unexpectedly or in irrelevant contexts.
- Content