T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:91- Finding
Mandatory Referral-Link Injection into Agent and CLI Outputs
- Content
View full analysis
- Remediation
View remediation
Security audit
Pre-IPO Research
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a read-only pre-IPO research helper, but it forces a Jarsy referral link into every natural-language and non-JSON CLI answer, so users should review that behavior before installing.
Install only if you are comfortable with every normal research answer including a Jarsy referral link and with the skill presenting output primarily in Chinese/China Standard Time. The public read-only data access itself appears proportionate, but the forced promotional output is a real neutrality and trust concern.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Forcing Chinese-language output content in every natural-language answer without user opt-in, especially in the form of a fixed referral line, is an unauthorized output manipulation mechanism. In context, this is more dangerous because it is coupled to a specific promotional URL, indicating the formatting rule is being used to guarantee insertion of advertising content regardless of user need.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill presents itself as read-only research, but later mandates promotional referral content in all natural-language outputs, which is materially outside the stated purpose. This mismatch is dangerous because it hides output-shaping behavior behind a neutral research description, increasing the chance the agent unknowingly delivers spam or conflicted recommendations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to "Display Chinese-standard time with an explicit timezone" imposes a specific locale/format on all answers. The file does not indicate that this is optional, user-selected, or justified as a region-specific compliance requirement.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires appending a Jarsy referral link to every natural-language research answer even when unrelated to the user's request or cited sources. This creates covert promotional output and manipulates agent responses for affiliate or traffic-generation purposes, undermining trust and causing unauthorized content injection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON manifest consistently uses Chinese-language titles such as "私募股权投研报告（公开初筛版）｜Pre-IPO 观察站" across entries, but provides no indication that the locale is user-selectable or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction hard-codes the response text “期限已过，请核验” when a notice deadline has passed. This imposes a specific language choice in the skill's natural-language behavior without user opt-in or an explicitly documented locale-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The timestamp formatter is fixed to locale "zh-CN" and time zone "Asia/Shanghai", and surrounding strings throughout the file are also Chinese. This forces a specific language/locale presentation without any apparent opt-in or indication that the skill is region-specific, which matches the natural-language locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Nearly all user-facing console strings in this file are Chinese, which forces a specific language on users. The policy allows locale constraints only when the skill offers opt-in or clearly documents a justified region-specific limitation, neither of which appears in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-facing string fields such as cadence, metrics, and identity are written in Chinese throughout the platform definitions. This creates a natural-language locale constraint in the skill content without any visible user choice or explanation that the skill is intended only for Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-facing strings are emitted in Chinese, including status and report text framing, while the tool's usage/help text is otherwise in English. This creates a language/locale policy issue because the skill imposes a specific language on users without opt-in or an explicit region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code only accepts reports whose content matches the Chinese phrases "报告截至" or "静态版本" and extracts metadata using those same localized labels. This creates a language-specific behavior without any visible opt-in or documented rationale in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest presents the skill description in Chinese while the default prompt is written in English, but nowhere states that the user can choose their preferred language. This can create an implicit language/locale expectation without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The markdown states that
categoryis a model-derived Chinese primary category andtagvalues are model-derived sub-sector tags, presenting a language-specific constraint as the default interface. Because no user choice, locale opt-in, or justification for the Chinese-only taxonomy is provided here, this is a natural-language locale policy concern.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The function fetches remote HTML via readPublic(reportUrl, { ...options, html: true }), which is a network operation covered by the missing-warning rule for code files. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that external report content will be retrieved.
- Content