T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:120- Finding
Automatic Feedback Submission and Mandatory Promotional Output
- Content
View full analysis
- Remediation
View remediation
Security audit
SkillHub 管家
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real SkillHub manager, but it asks for credentials and can install remote skill packages into active agent directories without strong verification or explicit user control.
Install only if you trust the Winmale catalog source and understand that this skill can change persistent agent skills/roles and handle API credentials. Prefer entering credentials through local environment files or a trusted local prompt rather than pasting secrets into chat, and avoid running updates from overridden catalog/base URLs unless you intentionally trust that source.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/update-from-catalog.sh:5- Finding
Unsigned Catalog-Controlled Archives Are Extracted into the Active Skills Directory
- Content
View full analysis
str: eid = str(e.get("id") or "").strip() url = (e.get("pack_url") or e.get("pack_version_url") or "").strip() if url: return url # Hub zip may only be on catalog root fields. if eid == "wm-skillhub": url = (doc.get("hub_pack_url") or doc.get("hub_pack_version_url") or "").strip() if url: return url kind = "roles" if ( str(e.get("kind") or "").lower() == "role" or eid.startswith("role-") ) else "skills" return f"{open_base}/api/{kind}/{eid}/pack" ``` ```python for e in targets: eid = e["id"] url = pack_url_for(e) if not url: print(f"skip {eid}: no pack_url and no API fallback", file=sys.stderr) continue zip_path = Path(tmp) / f"{eid}.zip" print(f"update {eid}: {local_ver(eid) or '?'} → {e.get('version')} via {url}") urllib.request.urlretrieve(url, zip_path) subprocess.check_call(["unzip", "-oq", str(zip_path), "-d", skills_root]) ``` ### Technical Analysis The update process trusts both an environment-configurable catalog URL and package URLs supplied by that catalog. It downloads the selected archive and directly extracts it into the active Skills root. No controls shown in the audited script verify: - That the catalog uses the expected official HTTPS origin. - That a `pack_url` belongs to an approved origin. - That redirects remain on an approved HTTPS origin. - A cryptographic package hash. - A signed catalog or package manifest. - The archive's file paths before extraction. - The archive ...[truncated 3120 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 用官方 `pack_url` / install 合同安装或更新 skill 与 role，并做 frontmatter + sidecar 验收 | 使用来路不明的第三方 zip；留下剥光 YAML 的损坏 `SKILL.md`；用 `install/skills/` 装 Role |
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This guidance operationalizes secret exfiltration by asking the user to transmit App ID and API Key to the agent for configuration. In the context of a skillhub/credential-management skill, this is especially dangerous because the requested values are precisely the credentials that authorize access to the platform and other managed skills.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh curl -fsSL "$CATALOG_URL" -o "$TMP_DIR/catalog.json" ENV_FILE="$HUB_DIR/.env" ENV_BAK="" if [[ -f "$ENV_FILE" ]]; then ENV_BAK="$TMP_DIR/env.bak"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh curl -fsSL "$CATALOG_URL" -o "$TMP_DIR/catalog.json" ENV_FILE="$HUB_DIR/.env" ENV_BAK="" if [[ -f "$ENV_FILE" ]]; then ENV_BAK="$TMP_DIR/env.bak"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh curl -fsSL "$CATALOG_URL" -o "$TMP_DIR/catalog.json" ENV_FILE="$HUB_DIR/.env" ENV_BAK="" if [[ -f "$ENV_FILE" ]]; then ENV_BAK="$TMP_DIR/env.bak"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh fi if [[ -f "$ENV_FILE" ]]; then echo ".env present" else echo "WARN: no .env — open $OPEN_BASE/skillhub/creds to copy keys if needed" >&2 fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh fi if [[ -f "$ENV_FILE" ]]; then echo ".env present" else echo "WARN: no .env — open $OPEN_BASE/skillhub/creds to copy keys if needed" >&2 fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to read and write local files, make network requests, and execute shell commands, yet it declares no tool-scope restrictions such as permissions or allowed-tools. In a package whose purpose is installing and updating other skills, this creates a broad implicit trust boundary: a compromised or tampered skill can perform privileged local and remote actions without any machine-readable limitation or sandbox contract.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The skill directs downloading a remote ZIP and unzipping it into the local skills root without any integrity verification such as checksum, signature validation, or pinned digest. Because this skill is a bootstrap/update manager and also handles credential configuration, a supply-chain compromise or man-in-the-middle on the package source could lead to arbitrary malicious skill installation, persistence, and possible exposure or misuse of local secrets.
- Content
优先路径 A — 官方 pack：
bash curl -fsSL "https://open.winmale.com/api/skills/wm-skillhub/pack" -o /tmp/wm-skillhub.zip mkdir -p "<skills_root>" unzip -o /tmp/wm-skillhub.zip -d "<skills_root>"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes the skill as handling credential configuration, browsing official directories, and installing or updating other skills/roles, but the activation text is broad and non-specific. Combined with implicit invocation, this can cause the skill to be selected in loosely related contexts, increasing the chance of unnecessary credential handling or package-management-like actions without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest name, description, summary, author label context, sample prompts, and expertise tag are all presented only in Chinese, with no indication that users may choose another language. This creates a natural-language locale constraint that is not documented as optional or justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly tells users to send App ID and API Key back to the agent, which encourages disclosure of long-lived credentials through the chat channel. Even though it says not to echo the secrets back, that does not mitigate the core risk: the model/session may log, retain, or mishandle the credentials, enabling account compromise or unauthorized API use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The title and instruction text require user-visible responses to follow rules written entirely in Chinese, indicating a fixed language expectation for outputs. There is no visible opt-in, fallback, or user language choice, so this constitutes a language/locale policy issue under the natural-language policy rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The only user-facing description in this manifest is provided under
description_zh, with no accompanying multilingual option or indication that the skill is intentionally region-specific. This can violate language/locale policy expectations because it implicitly constrains the skill's presentation to Chinese without user opt-in.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The display name and descriptions are written in Chinese, but the manifest does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking context. This can constitute a language/locale policy issue when users are not given a choice or justification for the enforced locale.
- Content