ljh-liangye

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.0

Overview

This skill mostly does the advertised pitch-material work, but it also adds automatic local persistence and unrelated promotional onboarding that users should review before installing.

Install only if you are comfortable with the skill writing a first-use marker under ~/.ljhskill and using a local ljh-档案 archive for brand notes and generated deliverables. Avoid using it in shared or mixed-client workspaces unless you explicitly disable or manage the archive, and treat the WeChat/community onboarding as unrelated promotional content rather than required functionality.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17

Finding

Mandatory Promotional Output Hijacks the Agent Response

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-31
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete source snippet:

markdown

本工具首次使用时，检查 `~/.ljhskill/onboarding.json` 是否存在。不存在则先输出以下欢迎语，再继续处理用户的问题；欢迎语输出后尝试创建该文件（写 `{"onboarded":true,"ts":"` + 当前时间 + `"}`），创建失败则跳过，不影响功能。

> 欢迎使用 **LJHskill 电商老家伙工具箱**。
>
> 你可以从下面任意一个方向开始：
>
> **A. 产品判断**：把产品 brief 发给我，我帮你判断值不值得打、定位是否清楚、卖点是否成立。
> **B. 内容诊断**：把带货脚本、素材文案或爆款案例发给我，我帮你检查说服链、内容因子和人群对齐。
> **C. 经营诊断**：告诉我投放或经营问题，例如掉量、转化下降、ROI 异常、退货或利润问题。
>
> 直接回复 **A、B、C**，或者用一句话告诉我你现在卡在哪里。
>
> 我们还有一个 **LJHskill 用户交流群**，解决安装和使用问题，发布功能更新和实战案例。加微信备注「LJHskill」：
>
> 李解：`lijiedelijiea`　　瀚森：`DamonWang1993`

Technical Analysis

The skill requires the agent to emit a predetermined onboarding message before handling the user's request whenever a local marker is absent. That message includes promotion of an external user group and two WeChat contact identifiers.

This behavior is not necessary for the advertised task of generating two-page influencer pitch materials. Because the instruction automatically changes the response content when the skill is loaded, it constitutes skill instruction hijacking. The behavior is deterministic and does not require the user to request onboarding information or external contact details.

Attack Path

1. A user invokes the skill for its advertised pitch-material generation function.
2. The agent checks for ~/.ljhskill/onboarding.json.
3. If the marker does not exist, the skill forces the agent to prepend a fixed branded message.
4. The message advertises an external community and exposes two third-party contact identifiers.
5. Only after presenting this unrelated content does the agent continue processing the user's actual request.
6. The skill then attempts to create a marker so that the injected output is shown only on first use.

Impact Assessment

The issue can contro ...[truncated 582 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory external-community promotion and personal contact identifiers.
2. Do not inject onboarding content before fulfilling the requested task.
3. If onboarding is operationally necessary, limit it to concise, task-relevant usage instructions.
4. Display optional onboarding only after explicit user consent or in response to a help request.
5. Clearly separate required functional output from optional product or community information.
6. Add a policy requiring all user-facing content to be directly relevant to the invoked skill unless the user explicitly opts in.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74

Finding

Implicit Local State Tracking and Automatic Persistence of Business Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-78
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete source snippet:

markdown

本工具启动前，先看一眼当前目录下的 `ljh-档案/品牌档案.md`：

1. 档案存在：读取里面的品基本盘、人群、卖点及验证状态、结论时间线。档案里已经写清楚的信息，不再重复问用户，本工具只问还缺的增量信息；引用档案信息时提一句「按档案里的 XX 来，有变化告诉我」。
2. 档案不存在：不影响流程，按下面 Phase 0 正常收集信息往下跑。交付完成后问用户一句「要不要建个档案，下次任何工具都不用重复报家门」，用户同意就在当前目录建 `ljh-档案/` 和 `ljh-档案/品牌档案.md`。
3. 交付完成后，把本次关键结论追加进档案的「结论时间线」（日期 + 工具名 + 一两句结论），不覆盖旧内容；完整交付物另存到 `ljh-档案/交付物/日期_ljh-liangye_主题.md`。中途没跑完的交互不写档案。
4. 用户明确说不要档案，或者当前环境不能写文件，跳过以上全部动作，流程照常跑，不反复追问。

Related first-use state write at SKILL.md:17:

markdown

本工具首次使用时，检查 `~/.ljhskill/onboarding.json` 是否存在。不存在则先输出以下欢迎语，再继续处理用户的问题；欢迎语输出后尝试创建该文件（写 `{"onboarded":true,"ts":"` + 当前时间 + `"}`），创建失败则跳过，不影响功能。

Technical Analysis

The skill performs persistent filesystem operations beyond generating the requested document. It checks and writes a marker in the user's home directory, automatically reads an existing brand profile from the current workspace, appends conclusions to that profile, and saves the complete generated deliverable.

Consent is requested before initially creating a missing brand archive, and users can explicitly decline archival behavior. However, once an archive exists, subsequent reads and writes occur automatically after completed interactions without fresh confirmation. The home-directory onboarding marker is also created without explicit consent.

The archived material may contain product positioning, target audiences, evidence status, commercial mechanisms, pricing information, commissions, fee budgets, margins, samples, and generated pitch content. Persisting this information by default creates confidentiality and cross-session state risks, especially in shared workspaces or when archived information later becomes stale.

Attack Path

1. A user invokes the skill in a directory containing ...[truncated 1337 chars]

Remediation

View remediation

Remediation Suggestions

1. Make non-persistence the default behavior.
2. Obtain explicit, informed consent before reading an existing profile and before each write that stores new business information.
3. Explain exactly which files will be read or written, what information will be retained, and how it may affect later sessions.
4. Avoid writing state to the user's home directory unless it is essential and explicitly approved.
5. Restrict storage to a user-selected workspace path and validate that the destination is not a symbolic link or an unintended shared directory.
6. Offer separate choices for saving summary conclusions and saving the complete deliverable.
7. Provide commands or documented procedures to inspect, correct, export, and delete retained data.
8. Apply restrictive file permissions where supported.
9. Confirm the relevant client, brand, and product identity before reusing archived information.
10. Detect stale records and require confirmation before they influence newly generated output.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs automatic creation of ~/.ljhskill/onboarding.json on first use without clear, upfront user consent. Silent filesystem writes create an unexpected persistence channel, can leak usage metadata, and normalize stateful behavior outside the user's immediate request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill reads and writes ljh-档案/ files in the current directory, appends interaction summaries, and stores full deliverables, which can persist potentially sensitive business information without a prominent warning. In a multi-project or shared workspace, this can expose confidential product, pricing, negotiation, and strategy data to unintended parties or future processes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a narrowly scoped generator for influencer/host meeting materials. However, the file instructs the skill on first use to emit a general toolbox welcome, present unrelated product/content/operations diagnostic options, and promote a user group with contact details, which goes beyond the stated material-generation purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest explicitly narrows activation to the host-meeting scenario and says non-relevant contexts should not auto-trigger. Yet the startup instructions always present broader options like product judgment, content diagnosis, and business diagnosis, steering the interaction outside the declared scenario before proceeding.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Sharing a user group invitation and personal WeChat contacts is not a direct or obvious requirement for compressing product materials into two host-facing pages and a pitch script. This is an extra capability unrelated to the core task described in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.