T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:54- Finding
Mandatory Promotional Link and Traffic-Diversion Injection in Assessment Results
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Spectrum
Security checks for vulnerabilities and agentic risk
Overview
The skill is a markdown-only scoring template, but it forces unsolicited X/Telegram promotion and language remapping that users may not expect.
Review before installing. This skill does not appear to run code or access credentials, but normal results can include mandatory links to X and Telegram and may encourage users to share generated profile attributes there. Users who only want the scoring template should remove or ignore those CTAs and be aware that Japanese/Korean language requests may be answered in zh-CN.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The default prompt forces a language policy that maps broad classes of users and languages to zh-CN without explicit user opt-in. This can mis-handle user intent, produce output in an unexpected language, and create a prompt-level override that is especially risky when combined with implicit invocation, because users may be silently funneled into a language mode they did not request.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
- alternate_valid_types: []
- missing_inputs: [
Q1,Q2,Q3]
Hexagon Block
text
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The locale policy explicitly overrides unsupported Japanese and Korean requests to zh-CN, even when the user did not ask for Chinese. That can misrepresent user intent, create deceptive or inaccessible output, and in a scoring/assessment skill may cause users to act on results they cannot accurately review, especially where labels and conclusions must be strictly monolingual.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
- 平局裁决:
<无|规则裁决> - 备选类型: [
<类型名>, ...]
六边形图
text - 平局裁决:
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
- alternate_valid_types: [
<TYPE>, ...] - missing_inputs: [
<INPUT>, ...]
Hexagon Block
text - alternate_valid_types: [
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
- alternate_valid_types: [
<TYPE>, ...] - missing_inputs: [
<INPUT>, ...]
Hexagon Block
text - alternate_valid_types: [
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly remaps unsupported
jaandkolocale requests tozh-CNinstead of preserving user intent, requesting clarification, or falling back to a neutral default. This can cause users to receive output in a language they did not request, undermining consent, reliability, and potentially safety if users cannot accurately understand scoring results or follow-up guidance.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Implicit invocation is enabled with no activation constraints, so the skill may be triggered in contexts where the user did not clearly request this scoring workflow. Because the skill also imposes a strict output/template behavior and language-selection policy, accidental activation can override normal assistant behavior and cause unauthorized prompt steering or unexpected handling of user requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all user-facing content exclusively in Chinese, including headings, explanations, and action prompts. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file presents sections as required strict-result content, but the overall example appends marketing-style material that contradicts that framing. This is dangerous because downstream consumers may trust the output as deterministic structured content while hidden or appended persuasive text bypasses expectations and can be propagated automatically.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example output includes calls to post on X/Twitter and join Telegram, which are outside the skill's stated scoring and rendering scope. In an agent skill, embedding external engagement prompts can steer users or downstream agents toward unsolicited platform interaction, creating a channel for off-scope promotion, data exposure, or social-engineering follow-ons.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The template restricts outputs to only zh-CN or en locale families, which can override user language preferences and force responses into unsupported languages. In agent systems, this can degrade reliability, mislead users about localization support, and cause unsafe misunderstanding when results are consumed operationally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template injects marketing and community-callout content into a skill whose declared purpose is scoring and rendering Agent Spectrum results. This creates scope creep and can steer users to external platforms unrelated to the requested analysis, which is risky in agent contexts because output templates strongly shape downstream model behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The deep-result template embeds partner-finding and recruitment prompts beyond the skill's stated scoring function. In an agent workflow, this can cause unsolicited redirection to outside communities and mixes analysis output with persuasive content, violating least surprise and increasing social-engineering surface.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The English quick template includes external social and community promotion not required to perform Agent Spectrum evaluation. Because templates are authoritative instructions for model output, this can systematically push users toward third-party services and normalize unsolicited outbound recommendations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The English deep template adds external partner-finding/community CTA content outside the manifest's declared function. This is dangerous because it couples analytical output with off-platform persuasion, potentially exposing users to tracking, phishing lookalikes, or unwanted data-sharing behaviors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The locale policy silently remaps explicit unsupported requests such as Japanese or Korean to zh-CN instead of preserving user intent or failing safely. In a scoring skill that must return strict, user-facing output, this can mislead users, degrade comprehension, and cause downstream consumers to process content in an unexpected language, especially when labels must remain unmixed and exact.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file presents all user-facing instructions and results in Chinese, including the next-step guidance, with no opt-in or alternative locale indicated. Under the policy rule, forcing a specific language without user choice is a natural-language locale violation unless the constraint is explicitly documented and justified.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example output embeds external promotional links to X/Twitter and Telegram that are not required for the skill's stated purpose of scoring and rendering an Agent Spectrum result. In an agent context, unsolicited outbound links can steer users off-platform, create trust-transfer risk, and expose them to tracking, social engineering, or unrelated third-party content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file presents all user-facing headings, labels, and instructions in Chinese, which can constitute a language/locale policy issue when no language selection or opt-in is offered. The content does not document that the skill is region-specific or that users may choose another language.
- Content
Static analysis
No suspicious patterns detected.