Eai Awesome Work

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:37 AM UTC
• Version: 1.0.0

Overview

This skill is a public arXiv newsletter-writing helper with no executable code or privileged behavior, though users should review its broad triggers and fixed source footer.

Install only if you want a Chinese embodied-AI roundup generator. Review or edit the footer before publishing so it lists only sources actually used, and invoke the skill with specific requests to avoid accidental activation from generic phrases.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:105
• Finding: Mandatory Unverified Third-Party Attribution in Generated Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105–108 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown #### 页脚 ``` *本文基于 YYYY-MM-DD arXiv cs.RO/new 页面抓取 + 论文详情页自主研读编译。数据来源：arxiv.org、humanoid.press。* ``` ``` English translation: ```markdown #### Footer *This article was compiled through independent review of the YYYY-MM-DD arXiv cs.RO/new page and paper detail pages. Data sources: arxiv.org, humanoid.press.* ``` ### Technical Analysis The Skill requires every generated article to include `humanoid.press` as a data source. However, the mandatory paper-discovery and information-collection phases only require retrieval from `arxiv.org`. The optional industry-news phase permits general web searches but does not require or guarantee access to `humanoid.press`. Consequently, the footer can cause the agent to publish an unsupported source attribution even when that domain was never consulted. This instruction alters final output beyond the substantiated results of the research workflow and persistently inserts a third-party reference into every generated article. ### Attack Path 1. A user invokes the Skill to generate an embodied-AI weekly review. 2. The agent retrieves paper listings and abstracts from `arxiv.org`. 3. The agent does not access `humanoid.press`, either because the optional industry-news phase is skipped or because other sources are used. 4. During article generation, the mandatory footer instruction is applied. 5. The resulting article identifies `humanoid.press` as a data source despite no information having been retrieved from it. 6. If the article is published, the unsupported attribution is propagated to readers as part of the final content. No system privileges, credentials, or code-execution capabilities are obtained through this path. The affected scope is the integrity and provenance of content generated by this Skill. ### Impact Assessment The ...[truncated 616 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the fixed `humanoid.press` attribution from the mandatory footer. 2. Construct the source list dynamically from URLs that the agent actually accessed during the current run. 3. Track successful retrievals and only attribute a domain when information from that domain materially contributed to the article. 4. Use a neutral default footer, such as: ```markdown *This article was compiled from the sources cited in each entry. Access date: YYYY-MM-DD.* ``` 5. Require inline citations for industry-news claims so that each claim can be traced to the source actually used. 6. If `humanoid.press` is intended to be a required source, add an explicit retrieval and verification step and handle failed or skipped retrieval without attributing the domain. 7. Allow users to review or override publication footers before generated content is saved or distributed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation rules describe when to activate but do not define boundaries for when not to activate, leaving room for the skill to respond to loosely related prompts. In a multi-skill agent, ambiguous routing can lead to wrong skill selection, unintended external fetches, and generation of off-target content from user prompts that merely mention related topics.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase set includes very broad terms such as "awesome work" and "具身论文汇总", which can match generic user requests that are not clearly asking for this specific skill. This can cause unintended activation and unnecessary web access or content generation, especially in environments with many skills competing on overlapping keywords.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The template explicitly instructs authors to provide a Chinese translation: "摘要翻译" and "流畅的中文翻译". Because this is a markdown instruction file and no opt-in or alternative language choice is offered anywhere in the template, it creates a language policy constraint that applies by default.

Static analysis

No suspicious patterns detected.