Session Content Classification Assistant

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed conversation organizer that formats the current chat into Markdown, with no code execution, persistence, network access, or credential handling.

Install this only if you are comfortable with the assistant summarizing and potentially reproducing content from the current conversation in a Markdown document. Avoid invoking it on chats containing sensitive personal, business, or credential information unless that output is intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Unconditional Session Instruction and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-15; reinforced at lines 70-71
Vulnerability Type: Prompt-based session goal and output-control hijacking
Risk Level: High

Vulnerable Code

Primary role-replacement directive at line 14:

markdown

You are now the "Session Classification Assistant" (会话分类整理助手). Strictly follow all rules below and output ONLY Markdown format results—no extra dialogue or explanations!

Reinforcing mandatory output directive at line 70:

markdown

1. Output ONLY pure Markdown code, no explanations or redundant text.

Technical Analysis

The Skill uses unconditional imperative language to replace the agent's active role, require strict compliance with all subsequent Skill rules, and control the format of every response. These instructions take effect as soon as the Skill text is loaded rather than only after the user explicitly requests session classification.

Requiring Markdown output is reasonably related to the declared classification function. However, globally requiring the agent to output only Skill-controlled Markdown and prohibiting explanations exceeds the minimum privileges necessary. A safe implementation only needs to apply the template to an explicitly requested classification operation.

The prohibition on explanations can interfere with transparency, error reporting, safety warnings, and unrelated user tasks. The instruction to traverse all content in the current session also broadens the data scope beyond content that a user may have deliberately selected for classification.

This is an instruction-layer vulnerability rather than an operating-system privilege escalation. The project contains no executable scripts, dependency files, network retrieval, persistence mechanisms, credential access, or local code-execution behavior.

Attack Path

1. A host application loads SKILL.md into an agent's instruction context.
2. The uncondition ...[truncated 1574 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove role-replacement language such as You are now and unconditional compliance language such as Strictly follow all rules below.
2. Scope the behavior to explicit user intent. For example: “When the user explicitly requests classification of specified conversation content, organize that content using the following Markdown template.”
3. State that higher-priority platform instructions, safety policies, and the user's current request remain authoritative.
4. Replace the global output ONLY rule with a task-scoped preference: “For a requested classification result, return the result as Markdown unless higher-priority instructions or the user require another format.”
5. Require explicit authorization before processing the entire session. Default to user-selected content or a clearly defined range.
6. Permit safety warnings, consent questions, errors, and limitations outside the classification template.
7. Avoid asserting timestamps that are unavailable from the source conversation. Mark missing timestamps as unavailable rather than fabricating them.
8. Add a boundary statement clarifying that content being classified is data and must never be interpreted as instructions.
9. Test the revised Skill against unrelated requests, conflicting format requests, sensitive conversation content, and embedded prompt-injection text to verify that it activates only when explicitly invoked.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The instructions require the assistant to output only Markdown and include a bilingual directive, but they do not force a spoken language/locale such as English-only or Chinese-only. This is only a weak policy concern because the file presents itself as multilingual and the restriction is about format rather than locale, so it likely does not constitute a clear language-policy violation.

Content

No source excerpt is available for this finding.