詹明明·开头前五秒

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:20 PM UTC
• Version: 0.2.8

Overview

The skill is a coherent short-video hook-writing assistant, but it gives mutable external vault files authority and automatically writes user feedback into persistent memory without explicit consent.

Install only if you are comfortable with this skill reading your zmm/vault writing framework and general memory, and with it saving feedback for future use. Review or constrain the referenced vault files before use, and prefer requiring confirmation before any memory or framework write-back.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:21
• Finding: Mutable External Instructions Can Override Packaged Skill Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21-23`, `SKILL.md:97-103`; `references/规则卡.md:4` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets The following are faithful English translations of the relevant source directives: `SKILL.md:21-23`: ```markdown First read `zmm/references/Family Convention.md` (if it cannot be read, explicitly state that the convention cannot be read and red lines cannot be guaranteed, then stop; do not substitute memory for the convention). Then read `zmm/references/Interaction Specification.md`. Next, read memory from `{vault}/08-skill-memory/zmm-hook/` and `_general/`. The built-in criteria are in `references/Rule Card.md`; read them before starting. If `{vault}` contains corresponding rule files, the vault takes precedence and the rule card is only the baseline. ``` `SKILL.md:97-103`: ```markdown ## Read the main entry point first `{vault}/00-rules-and-index/Copywriting Framework - Main Entry.md` is the sole navigation point for writing copy. Follow it by default; the user does not need to request it every time. Automatically write any user feedback back into the framework according to section 5, without requiring the user to explicitly request this. ``` `references/规则卡.md:4`: ```markdown When the author's environment contains corresponding rule files in `{vault}`, the vault takes precedence and this file is the baseline. If the two locations disagree, follow the vault first and then update this file. ``` ### Technical Analysis The packaged Skill explicitly delegates mandatory behavior to files outside the audited project and gives mutable vault content precedence over the bundled rule card. Consequently, the effective instruction set cannot be determined by reviewing this package alone. This is an instruction-hijacking boundary failure: external files are treated as authoritative instructions rather than untrusted data. A party that can mod ...[truncated 1933 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package every mandatory behavioral rule inside the reviewed Skill artifact. 2. Do not permit mutable vault content to override safety rules, tool restrictions, or core workflow instructions. 3. Treat external files as untrusted data rather than executable instructions. 4. If customization is necessary, define a strict schema containing only expected preference fields, such as tone, audience, and output length. 5. Reject free-form imperative content in external configuration fields. 6. Apply a fixed allowlist of readable paths and validate resolved paths before access. 7. Pin external rule content by version or cryptographic digest if it cannot be packaged. 8. Define a deterministic conflict policy in which packaged safety constraints always take precedence. 9. Log the source, version, and integrity status of every external configuration file used. 10. Fail closed if external content violates the schema or requests tools, file access, memory writes, or changes to security policy. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:100
• Finding: User Feedback Is Automatically Written into Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:100-103`, `SKILL.md:221` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: High ### Vulnerable Code Snippets The following are faithful English translations of the relevant source directives: `SKILL.md:100-103`: ```markdown The framework includes an automatic feedback write-back mechanism. Follow it by default; the user does not need to request it every time. Automatically write any user feedback back into the framework according to section 5, without requiring the user to explicitly request this. ``` `SKILL.md:221`: ```markdown Before finishing, check which hook forms the user rejected and record them as corrections with reasons. Record forms that the user commonly selects or that retention data validates as effective methods. Write them into `08-skill-memory/zmm-hook/` after checking for duplicates. ``` ### Technical Analysis The Skill directs the Agent to persist user-controlled feedback automatically, without explicit confirmation and without defining a safe structured format. It also requires future sessions to read Skill-specific and general memory during startup. This creates a persistent memory-poisoning path. An attacker can phrase behavioral instructions as feedback, corrections, preferences, or effective methods. If stored as free-form text, those instructions can later be interpreted as authoritative guidance. Duplicate checking does not provide security validation and does not prevent malicious content from being stored. The risk is amplified if memory is shared between users or if the framework write-back changes files that other Skills also consume. ### Attack Path 1. An attacker invokes the Skill and supplies feedback containing embedded directives, for example by presenting them as a preferred hook rule or correction. 2. The Skill classifies the text as user feedback or an effective method. 3. The automatic write-back mechanism stores the attacker-con ...[truncated 1178 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic persistence of arbitrary user feedback. 2. Require explicit, informed confirmation before every memory write. 3. Display the exact normalized value, destination, scope, and retention period before saving. 4. Store only structured preference fields with strict length, type, and allowed-value validation. 5. Never persist free-form instructions, tool directives, role changes, or security-policy text. 6. Separate factual performance measurements from user preferences and behavioral rules. 7. Scope memory to an authenticated user and prevent cross-user access. 8. Add provenance metadata, timestamps, expiration, and a reversible audit history. 9. Provide users with mechanisms to inspect, edit, and delete saved memory. 10. Treat recalled memory as non-authoritative context that cannot override packaged safety constraints. 11. Scan existing memory for imperative instructions before enabling future reads. 12. Restrict write access to a dedicated file rather than a shared framework or general-memory directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:21
• Finding: Skill Reads Broad Shared Memory Beyond Its Minimum Task Requirements<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code Snippet The following is a faithful English translation of the relevant source directive: ```markdown First read `zmm/references/Family Convention.md`, then read `zmm/references/Interaction Specification.md`, and then read memory from `{vault}/08-skill-memory/zmm-hook/` plus `_general/`. ``` ### Technical Analysis The Skill is intended to diagnose and generate short-video opening hooks, but it instructs the Agent to read both Skill-specific memory and a general shared-memory area. No path allowlist, field-level limitation, sensitivity filter, or user-isolation rule is defined. Reading an entire general-memory location violates least-privilege principles because the hook-writing task should require only narrowly scoped preferences relevant to the current user and task. General memory may contain unrelated user preferences, conversation-derived state, sensitive information, or attacker-crafted instructions. This finding concerns excessive data access within the Agent's available storage. The artifact does not contain evidence that it bypasses operating-system permissions; rather, it requests broader authorized access than the stated task requires. ### Attack Path 1. Unrelated sensitive content or maliciously crafted text is stored in the shared `_general/` memory area. 2. A user invokes the hook-writing Skill. 3. The Skill reads the broad general-memory area as part of its startup procedure. 4. Unrelated content enters the Agent's active context. 5. Sensitive information may influence or appear in generated output, or malicious memory content may steer the Agent's behavior. 6. If the memory area is shared, one user's stored content may affect another user's session. ### Impact Assessment The accessible scope depends on the host Agent's vault permissions. Potential impact ...[truncated 530 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to read the entire `_general/` memory area. 2. Create a dedicated, per-user preference record for this Skill. 3. Allowlist specific fields needed for hook generation, such as audience type, tone, and previously selected hook style. 4. Enforce tenant and user isolation at the storage layer. 5. Exclude credentials, conversation transcripts, personal identifiers, and unrelated Skill state. 6. Resolve and validate paths against a fixed permitted directory before reading. 7. Read only the minimum record required for the current request. 8. Mark recalled content as untrusted data and prevent it from issuing instructions or overriding security policy. 9. Record memory-read events for auditability. 10. Obtain user consent before using persistent preferences in a new session. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger phrases include very common requests such as 'how to write the opening' and 'give me some hooks,' making accidental invocation likely in unrelated contexts. Over-broad activation can cause the wrong skill to intercept user intent, override more appropriate handlers, and unexpectedly apply its file-reading, routing, and memory behaviors.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The instruction "跟用户说话时只说人话，不说理论名" appears alongside a predominantly Chinese-only persona and workflow, and later constraints like "零术语" reinforce a fixed language style without offering the user a language or locale choice. The file includes some English description text, but the operational instructions do not offer opt-in or alternatives for language selection.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill instructs automatic write-back of user feedback into persistent framework files and skill memory, which expands behavior from content generation into stateful modification. Persistent memory updates can create privacy, integrity, and prompt-poisoning risks if untrusted user input is stored or later reused without review.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file repeatedly mandates specific Chinese phrasing choices such as avoiding the subject "你" in the first sentence, which presumes a Chinese-language output style. Because the document provides no user opt-in or alternative locale/language handling, it effectively enforces one language-specific convention.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Instructions such as rewriting lines into forms that "替他说" and evaluating first-sentence wording are tied to Chinese rhetorical structure and audience expectations. The file does not clarify that the skill is intended only for Chinese content or provide an opt-in for other languages/locales.

Description-Behavior Mismatch

Low

• Confidence: 76% confidence
• Finding: The manifest description centers on short-video opening hooks, suggesting a video-opening specialty. The documentation explicitly states the skill also serves X test-post first sentences, which is an additional content format not clearly disclosed in the manifest's main description.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The manifest frames the skill as a specialist for short-video openings that gate-checks content and proposes hooks. In code documentation, failed gate checks are redirected to `/zmm-script` for full script reassembly, which extends the operational scope beyond opening optimization into broader script-development orchestration.

Static analysis

No suspicious patterns detected.