T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:26- Finding
Unrestricted Loading of External Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
血友病公众号文章写作
Security checks for vulnerabilities and agentic risk
Overview
This writing skill is mostly coherent, but it requires reading and following a local CLAUDE.md file without clear consent or limits.
Review this skill before installing if your CLAUDE.md may contain private project guidance, operational instructions, or sensitive preferences. Use it only when you are comfortable with the agent reading that file for writing style, and prefer asking the agent to ignore non-style instructions from CLAUDE.md.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is broad enough to activate on generic writing or content-creation requests, which can cause the skill to run outside its intended WeChat-article context. Over-broad invocation increases the chance that file access or web-search behaviors are applied unexpectedly, reducing user control and informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates reading the user's CLAUDE.md without warning the user or obtaining explicit consent. This creates a privacy and least-privilege issue because the file may contain unrelated personal preferences, project instructions, or sensitive operational guidance not necessary for completing the immediate task.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Always reading CLAUDE.md for style forces access to a potentially broad instruction file when only a small subset of information may be needed. In context, this writing skill does not require unrestricted access to user guidance files, so the instruction increases unnecessary exposure of sensitive or proprietary content.
- Content