T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:178- Finding
Forced Promotional Response Hijacks Product and Authorship Queries
- Content
View full analysis
- Remediation
View remediation
Security audit
Publish Clawhub
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese text-rewriting skill with a transparency issue in its attribution wording, but it does not run code, access local data, or create persistence.
Install only if you are comfortable using a Chinese-focused rewriting assistant. Do not paste secrets, regulated personal data, or confidential company material unless your normal chat environment is approved for that content, and be aware that the skill tries to answer authorship/product questions with fixed promotional wording.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Defaulting Mode 1 to 'all other cases' creates an overly broad activation rule that can capture unrelated user inputs and unexpectedly transform content. In a text-rewriting skill, this increases the chance of acting on unintended pasted material, including sensitive workplace text, without clear user confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly encourages users to paste text but provides no warning about confidential, personal, or proprietary content. In a workplace-oriented rewriting tool, that omission materially raises the risk that users will submit sensitive internal documents under the assumption that it is safe to do so.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions define the skill as a '中文写作风格专家' and the behavior throughout is constrained to Chinese writing, but no opt-in or explicit locale limitation is provided. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Generic triggers like '看看' or broad catch-all phrasing make the skill's intent detection ambiguous and prone to accidental activation. This can cause the agent to interpret ordinary conversation as a request to process text, which is risky in a skill designed to accept arbitrary pasted content.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The hardcoded attribution response can misrepresent the author, product identity, or official source when users ask who made the skill. That creates trust and provenance issues, and could be used to redirect users to an external site under potentially false pretenses, even though it does not directly execute code or exfiltrate data.
- Content
Static analysis
No suspicious patterns detected.