Ae1
High
- Category
- analysis-evasion
- Content
- Start from `templates/report-template.html`, replace content, keep the CSS, navigation logic, reveal script and
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
vendor-summit-report
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent report-generation workflow with disclosed web research, local file output, templates, and a confirmation gate before any live publishing.
Install this if you want a structured analyst-style vendor conference report generator. Expect it to browse the web for current conference facts and create three local deliverables. Before letting it publish or push anywhere, confirm the destination and review generated facts, caveats, and language choice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Content
- Start from `templates/report-template.html`, replace content, keep the CSS, navigation logic, reveal script and
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Hidden Instructions
High
- Category
- Prompt Injection
- Content
<!DOCTYPE html> <!-- ⚠️ 模板说明：这是 Snowflake Summit 2026 的成品 HTML，作为「视觉与结构示例」保留。 一、直接复用（不需改）
- Confidence
- 70% confidence
- Finding
- Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Hidden Instructions
High
- Category
- Prompt Injection
- Content
<!DOCTYPE html> <!-- ⚠️ 模板说明:这是 Snowflake Summit 2026 的成品 HTML,作为「视觉与结构示例」保留。 一、直接复用(不需改)
- Confidence
- 70% confidence
- Finding
- Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
7. `[LLM]` Industry extension plus open questions 8. `[LLM]` Summary and one Strategic Planning Assumption 9. `[Deterministic]` Generate the three deliverables, then run the cross-file sync check 10. `[LLM]` Layout pass on the HTML — split and emphasize only, never rewrite 11. `[Deterministic]` Mechanical review — layer separation, caveats, numbering, red-line quotas 12. `[LLM]` Reader-fit review with a positioning lock and 3–4 representative roles 13. `[Deterministic]` Deliver, with channel confirmation before any live push
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Vague Triggers
Medium
- Confidence
- 91% confidence
- Finding
- The invocation guidance is broad enough to activate on ordinary user requests like 'use the same structure as last time' or generic summit-report phrasing, which can cause the skill to trigger when the user did not explicitly intend to run it. In agent environments, overbroad natural-language triggers can lead to unintended workflow execution, unnecessary web research, and generation or delivery actions beyond the user's clear consent.
Vague Triggers
Medium
- Confidence
- 88% confidence
- Finding
- The activation list includes generic phrases such as "专题报告" and "大会报告," which can overlap with ordinary requests for a general report and are broader than the specialized skill behavior described elsewhere. Although the file gives some context, it does not provide negative examples for these specific phrases or clearly constrain them to the fixed 8-section analyst-style output at the trigger point.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The HTML explicitly sets the document language to zh-CN and the title/content are written as a Chinese-only report template. For SQP-3, this is a natural-language locale constraint without any user opt-in or explanation that the template is intended only for a China-specific audience.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The instructional comments are written as mandatory guidance in Chinese, including prescriptive writing rules such as required section structure and phrasing. There is no indication that the template is region-specific or that users may choose another language, which makes this a natural-language locale policy issue under the stated rule.
Natural-Language Policy Violations
Low
- Confidence
- 86% confidence
- Finding
- One of the example invocations is written in Chinese, but the skill does not state that language follows user preference or that multiple output languages are supported. This can imply a locale/language assumption without explicit opt-in, which conflicts with language-choice policy expectations.
Static analysis
No suspicious patterns detected.