T01 · Skill Instruction Hijacking
Error
- Location
scripts/build_banker_prompt.py:7- Finding
Untrusted parameters and raw-data filenames are embedded directly into an executable agent prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
Banker Memo
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate CN banker-memo purpose, but it needs review because unvalidated filenames, paths, and parameters are embedded into a prompt sent to a main agent that can write files.
Install only if you intend to run a China-focused banker-memo workflow on raw-data you trust. Use a fresh output directory, avoid attacker-supplied filenames or JSON snapshots, and run the report agent with read access limited to the validated raw-data directory and write access limited to the chosen output directory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description restricts use to CN companies and uses Chinese trigger phrases and output framing without any opt-in or alternative language/locale behavior. This is a natural-language locale constraint that appears mandatory rather than user-selectable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt content is written as a mandatory Chinese analyst persona and requires producing a Chinese investment memo for named Chinese audiences, but it does not offer any language or locale opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The emitted prompt is entirely in Chinese and instructs the model to act as a China-focused investment banker for a Chinese listed company, which imposes a specific language/locale on downstream behavior. Under the stated policy, forcing a language without user choice or explicit opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The workflow instructs the agent to run commands that generate prompts, write deliverables, and compile outputs without an explicit warning or consent checkpoint about filesystem modifications. In an agentic environment, silent writes can overwrite existing work, create unexpected artifacts, or operate on attacker-influenced paths if
raw_dir/out_dirare not tightly controlled.- Content