Auto Skill Trigger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:58 AM UTC
• Version: 1.0.0

Overview

This skill is not overtly malicious, but it would automatically influence the agent's prompt and skill selection with weak scoping and unsafe handling of skill metadata.

Review this before installing in a shared or extensible skill environment. It should sanitize skill names and descriptions, treat installed skill metadata as untrusted, limit when automatic matching runs, and provide a user-controlled way to disable or confirm prompt hints.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Unsanitized Skill Metadata Is Injected into the Agent Prompt

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-42
Vulnerability Type: Prompt injection through untrusted skill metadata
Risk Level: Medium

Vulnerable Code

javascript

if (topSkills.length > 0) {
  return {
    prompt: `\n\n## Skill Hint\nFocus on: ${topSkills.map(s => s.skill.name).join(", ")}\n`
  };
}

Technical Analysis

Skill names returned by getAllSkills() are interpolated directly into an instruction-bearing prompt. The code applies no validation, escaping, length restriction, or removal of control characters before using s.skill.name.

If an attacker can register or install a skill with crafted metadata, its name can contain line breaks and instruction-like content that escapes the intended comma-separated list. The generated text may then be interpreted by the agent as additional trusted instructions rather than inert metadata.

The score is based on the skill description, so an attacker can also choose a description containing likely task keywords to increase the chance that the malicious skill reaches topSkills. This is an insecure prompt-construction pattern; the audited file does not establish that the project itself intentionally contains a malicious skill.

Attack Path

1. An attacker obtains the ability to make a skill visible to getAllSkills(), such as by convincing a user or administrator to install an attacker-controlled skill.
2. The attacker gives the skill a description containing keywords associated with targeted user requests.
3. The attacker crafts the skill name with newline-delimited instructions, for example a benign-looking name followed by text intended to redirect agent behavior.
4. A user submits a message whose extracted keywords overlap with the malicious description.
5. The scoring logic ranks the malicious skill above the configured threshold and includes it in topSkills.
6. The hook inserts the crafted name into the Skill Hint prompt without sanitization.
7. The age ...[truncated 684 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every value returned by getAllSkills() as untrusted input.
• Enforce a strict skill-name allowlist, such as ^[A-Za-z0-9._-]{1,64}$.
• Reject line breaks, control characters, prompt delimiters, markup, and other characters capable of changing the generated prompt structure.
• Avoid interpolating metadata into instruction-bearing prompt text. Supply matched skills through a structured data channel with explicit schema validation where supported.
• If textual prompt inclusion is unavoidable, serialize names using a safe encoding and clearly delimit them as untrusted data.
• Validate and constrain descriptions as well as names, because descriptions control ranking and can be manipulated to target common user requests.
• Apply trust or provenance checks before including installed skills in automatic matching.
• Add security tests covering malicious names, embedded newlines, instruction-like strings, oversized metadata, Unicode control characters, and keyword-stuffed descriptions.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 90% confidence

Finding

The hook injects a prompt fragment built from dynamically selected skill names directly into the model prompt. Because skill metadata is treated as trusted text and concatenated without strong delimiting or structured transport, a maliciously named or described skill could influence downstream model behavior, bias tool selection, or create prompt-injection-style control over the agent's planning context.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

scored.sort((a, b) => b.score - a.score);
  const topSkills = scored.slice(0, 5);
  
  // Return instruction to prioritize matched skills
  if (topSkills.length > 0) {
    return {
      prompt: `\n\n## Skill Hint\nFocus on: ${topSkills.map(s => s.skill.name).join(", ")}\n`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes the skill as automatically matching skills to the current task whenever a message arrives, but it does not define narrow activation boundaries, exclusion conditions, or negative examples. Because the matching is based on generic keyword overlap across all incoming messages, the trigger scope is ambiguous and could cause unintended skill invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The only listed message patterns are Chinese phrases, which implies a language-specific invocation style without stating that users may interact in other languages or that the skill is intentionally region-specific. This can conflict with language/locale policy expectations when no user opt-in or justification is provided.

Content

No source excerpt is available for this finding.