T01 · Skill Instruction Hijacking
Note
- Location
SKILL.md:28- Finding
Mandatory Third-Party Branding Alters User-Facing Deliverables
- Content
View full analysis
- Remediation
View remediation
Security audit
胡开奕 · 养老与传承顾问技能 · 解决方案
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Chinese retirement and inheritance planning document template with a local DOCX generator and no evidence of hidden network access, persistence, credential use, or destructive behavior.
Before installing, confirm that a Chinese retirement/inheritance planning workflow is what you want, and review the default branding, adviser name, slogan, disclaimer, and DOCX metadata before sending documents to clients. Financial, insurance, legal, tax, trust, and underwriting content should be reviewed by qualified humans and handled according to applicable compliance rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains user-facing instructions and generated document text entirely in Chinese, and the docstring explicitly directs users to run the generator to produce a Chinese-language document. There is no indication that language selection is optional or that the skill is explicitly limited to a Chinese-only regional/compliance context, which conflicts with the policy against forcing a specific language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list includes generic phrases such as retirement solution, inheritance solution, and pension plan terms that can match broad user requests unrelated to this specific skill. Overly broad activation increases the chance the skill is invoked in unintended contexts, causing scope hijacking, inappropriate financial guidance insertion, or routing users into a specialized advisory workflow without clear intent.
- Content
Static analysis
No suspicious patterns detected.