Micro Change Helper

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.1

Overview

This is a simple coaching skill that gives small habit and productivity suggestions, with some advice users should review before applying but no hidden code, persistence, or credential access.

Before installing, treat this as a habit/productivity coaching prompt. Review any suggested mailbox changes before acting, and avoid sharing personal details with third-party check-in groups or services unless you intentionally choose to use them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:87

Finding

Hard-Coded Third-Party Service Promotion in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 87
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete vulnerable instruction, translated into English:

text

Use a WeChat check-in group or the Xiaolai morning-and-evening check-in service, and post a sunrise or moon emoji every day.

Technical Analysis

The expected response for the habit-formation scenario contains a hard-coded instruction directing users to a WeChat group or a named third-party check-in service. This external-service recommendation is not necessary for the skill's stated purpose of reducing a difficult objective to a small, immediately actionable change.

Because the directive is embedded in the skill's expected output, loading the skill can influence the agent to reproduce the promotion when a user submits a matching habit-related request. The equivalent example in README.md does not include this external redirection, making the behavior inconsistent with the project's public-facing description.

This is classified as skill instruction hijacking because attacker-controlled skill text can alter the response generated in the current session by inserting an unrelated third-party recommendation. No evidence was found that the instruction retrieves a remote payload, executes code, modifies persistent memory, or bypasses system permissions.

Attack Path

1. A user or agent loads SKILL.md.
2. The user asks for help maintaining a habit, particularly using wording similar to the documented scenario.
3. The model treats the hard-coded expected output as response guidance.
4. The generated response recommends the specified WeChat group or named check-in service.
5. The user may follow the recommendation and leave the trusted skill environment for an external service.

Impact Assessment

The issue can cause unsolicited promotion and redirection to an external platform in otherwise benign c ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded reference to the WeChat group and named third-party check-in service.
2. Replace it with a provider-neutral suggestion, such as: “If helpful, record completion privately using a journal or a check mark.”
3. Require explicit user consent before recommending any external platform or community.
4. Ensure that expected-output examples remain narrowly aligned with the skill's declared purpose.
5. Reconcile SKILL.md with README.md so the public description accurately reflects all response behavior.
6. Add a review rule prohibiting undisclosed brands, communities, referral destinations, and external-service promotions in skill instructions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language policy requires avoiding forced language or locale constraints unless the user is given an explicit choice or the restriction is justified. Most of this README is written in Chinese, but it does not indicate that the skill is Chinese-only, region-specific, or that users may opt into another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file includes a concrete workflow that tells the user to archive 150 emails, unsubscribe from newsletters, and create filters, all of which can change user data or mailbox state. The description provides no warning about reviewing selections carefully or that these actions may affect retained messages and inbox organization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill describes a broad purpose ('Turn a stuck problem into one tiny actionable 5% change') but does not define concrete trigger phrases, exclusion conditions, or negative examples for when the skill should or should not activate. Because the scope overlaps with many common self-help or productivity requests, the trigger conditions are vague enough to risk unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L71-L73 state the skill should not output complex long-term plans. However, L77-L80 documents expected outputs such as a 4-level ladder, a 2-week tracker, and a 4-day protocol, which directly contradict the stated limitation and broaden the intended behavior beyond a single tiny action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill presents core instructions and scenarios primarily in Chinese while also including English usage examples, but it does not state whether responses should follow the user's preferred language. This can create an implicit language/locale constraint without user opt-in, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.