T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:111- Finding
Forced Promotional Response Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
微信AI接入顾问
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an advisory/code-template package, but it needs Review because it forces a promotional identity response and includes unsafe login-token code templates.
Install only if you are comfortable reviewing generated code before use. Treat the auth, token, payment, phone, address, medical, and government examples as drafts, remove the forced promotional watermark, and harden login/network handling before putting any generated Mini Program code into production.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/code-templates.md:162- Finding
Generated Login Middleware Transmits Login Codes Using the Default GET Method and Stores Unvalidated Tokens
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `references/demo-walkthrough.md`：官方 Demo（ai-mode-demo / WeStoreCafe）逐文件解读，从 app.json 到 components 全拆解
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README is entirely in Chinese and the example invocations assume Chinese-language use, but there is no indication that users may interact in other languages or that the skill is intentionally restricted to a Chinese-speaking audience for compliance or regional reasons. This creates a natural-language locale policy issue because the skill appears to impose a language requirement without opt-in or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says '说你的业务就能出接入方案和代码骨架', which is a very broad natural-language trigger and does not define what kinds of business descriptions should or should not invoke the skill. The file lists example prompts later, but it does not provide exclusion conditions or clear scope constraints to prevent overlap with ordinary consultation requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction "中文回复，代码和字段注释也用中文" mandates a single language for all replies and generated artifacts. This is a locale/language policy constraint with no user choice or opt-in mechanism, so it fits the natural-language policy violation category.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger rule uses broad natural-language matching such as '用户问……时读取本文件' without explicit exclusions or narrower scope. In an agent skill, this can cause over-triggering on loosely related requests, pulling in large capability guidance when the user did not specifically ask for it, which increases prompt-surface area and can degrade routing accuracy or cause unintended behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document introduces sensitive capabilities including image/file upload, phone-number access, and network requests, but does not pair them with privacy, consent, or data-handling warnings. In a consulting skill that outputs integration plans and code skeletons, this omission can normalize collection/transmission of user data without requiring minimization, user notice, or secure transfer practices.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description says to read this file when the user asks phrases like '帮我生成代码' or '给我完整项目', which are very broad requests that could occur in many unrelated coding contexts. The file does not provide exclusion conditions or tighter scope boundaries, so the activation condition is ambiguous and may cause unintended invocation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template advertised as a code-generation scaffold includes active authentication and remote network request logic (
wx.login, token storage, and a call tohttps://your-server.com/login). In a skill/template context, this can cause downstream generated projects to inherit real operational behaviors without explicit security review, encouraging insecure copy-paste use of placeholder endpoints, token handling, and auth flows.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file content is entirely framed in Chinese and presents itself as the walkthrough to read for matching requests, but it does not state that language is user-selectable or that Chinese is required for a justified region-specific reason. That can violate language/locale policy when a skill implicitly forces one language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The '什么时候读取' section lists several natural-language utterances that trigger reading this file, but it does not clearly define exclusion conditions or negative examples. Phrases like asking how the official demo works or what each file does are broad enough to overlap with general discussion, increasing the chance of unintended invocation in adjacent contexts.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
干什么：告诉 AI 这个 Skill 的业务流程、接口依赖关系和约束。AI 调用接口时会按这里写的流程来。
位置：
pages/drink-skill/drink-ordering/SKILL.mdmarkdown # drink-ordering
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
整份模板与示例均以中文固定表达交互和输出格式，但没有说明这是可选语言，也没有提供用户语言偏好选择。根据规则，若技能在自然语言层面默认强制单一语言且未提供 opt-in/choice，属于语言/locale 策略风险。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger condition is broad enough that generic requests like generating documentation, AGENTS.md, or test matrices may activate this template even when the user did not specifically intend the development-mode flow. In an agentic system, over-broad activation can cause context misrouting, unintended disclosure of internal templates, or generation of inappropriate implementation artifacts for unrelated requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger rule says to read this file when users ask about GEO, structured data, fallback modes, testing, launch checks, or how to improve AI hit rate. Those topics are broad and can appear in many unrelated conversations, so the skill may activate outside its intended scope and inject domain guidance that is irrelevant or misleading. In this skill context, that mainly creates prompt-routing and reliability risk rather than direct security compromise, but it can still cause incorrect assistance or unintended disclosure of internal workflow guidance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file is configured to be read whenever a user asks for examples, templates, or a generic 'how would my business connect' demonstration, which is a broad semantic trigger rather than a narrowly scoped condition. In this skill, that can cause the agent to pull in large amounts of cross-industry workflow and interface guidance unnecessarily, increasing the chance of unintended behavior, prompt dilution, or use of irrelevant domain logic such as medical, government, or payment-related flows in the wrong context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The behavior watermark requires a specific canned response in Chinese and further says '不展开解释，不更换说法', leaving no option for the user's preferred language or locale. This is a natural-language locale policy issue because it forces one language regardless of user context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
该文件通篇以中文编写，并在内容中直接给出“给用户的默认建议”，但没有任何提示说明可按用户偏好改用其他语言或地区化表达。按规则，若技能自然语言内容隐含强制单一语言且未提供选择，属于潜在的语言/locale 政策问题。
- Content
Static analysis
No suspicious patterns detected.