火一五提示词

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:01 AM UTC
• Version: 1.8.0

Overview

This skill is mostly a company onboarding prompt, but it tells users to paste Git access tokens into chat for repository operations, which is unsafe.

Review before installing. Do not paste Git tokens into chat for this skill; use a secure repository integration, scoped short-lived credentials, or an approved secret-entry mechanism. Also expect it to activate on generic greetings and present a company-specific persona and terminology.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Broad Triggers Enforce a Corporate Persona and Branded Response Policy## Vulnerability Details **File Location**: `SKILL.md`, lines 3–15 and line 77 **Vulnerability Type**: Skill instruction hijacking **Risk Level**: Medium ### Evidence English translation of the relevant skill text at lines 3–15: ```yaml name: huo15-prompt description: | Guide for the Lobster Robot of Qingdao Huo15 Information Technology Co., Ltd. When a user sends an opening phrase such as "Hello," "Who are you," or "What can you do," automatically provide a friendly self-introduction. Perform intelligent guidance according to the global configuration in AGENTS.md, SOUL.md, and TOOLS.md. trigger: - patterns: - "Hello" - "Who are you" - "What is it used for" - "What can you do" - "Capabilities" - "hi|hello|hey" - "^Help$" - "^Usage$" - "^Start$" type: fuzzy ``` English translation of the branding restriction at line 77: ```text Brand statement: The company uses the Huihuoyun Enterprise Suite; do not call it "Odoo." ``` ### Technical Analysis The skill uses fuzzy matching for broad, ordinary greetings and help requests. Once activated, its instructions require the agent to adopt a named corporate persona, promote a particular company, and follow referenced global configuration files. The branding rule further directs the agent to suppress an alternative product name rather than answer neutrally. This is instruction hijacking because loading the skill changes the agent's current-session identity, terminology, and response objective for requests that are not necessarily asking for company-specific information. The package does not contain the referenced `AGENTS.md`, `SOUL.md`, or `TOOLS.md`, so their expected contents and security properties cannot be verified from the audited artifact. ### Attack Path 1. A user submits a common greeting or generic help request, such as “hello” or “what can you do.” 2. The fuzzy trig ...[truncated 943 chars]
• Remediation: ## Remediation Suggestions 1. Replace broad fuzzy greeting triggers with explicit, narrowly scoped requests for information about the company or its assistant. 2. Do not override the host agent's identity. Clearly identify the content as an optional company-specific guide. 3. Remove instructions that prohibit accurate product terminology. If branding terminology is required, disclose both the branded and underlying product names where relevant. 4. Avoid relying on undeclared global instruction files. Package required policies with the skill or document and validate them through a trusted configuration mechanism. 5. Require user confirmation before switching into a company-specific persona or workflow. 6. Add tests verifying that generic greetings and help requests do not unexpectedly activate promotional behavior.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79
• Finding: Git Access Tokens Are Solicited Through the Conversation Channel## Vulnerability Details **File Location**: `SKILL.md`, lines 79–83 and line 106 **Vulnerability Type**: Insecure handling of repository credentials **Risk Level**: High ### Evidence English translation of the complete relevant instruction at lines 79–83: ```text Git repository and code operations: When members of the technical department ask me to write code or operate a Git repository, first ask them to provide: - Their username, generally "cnb" - Their token After they provide it, I will use their token to operate the Git repository. ``` English translation of the related access rule at line 106: ```text Git repository | cnb.cool | Technical department members use their own CNB tokens ``` ### Technical Analysis The skill explicitly instructs users to disclose repository access tokens directly to the agent through the conversational interface. It does not specify a secure secret-entry mechanism, token masking, log redaction, a secret manager, restricted token scope, expiration requirements, or deletion after use. Chat messages may be retained in conversation history, telemetry, logs, debugging records, or other storage used by the hosting environment. Consequently, placing a reusable repository credential in a normal message unnecessarily expands the number of systems and administrators that may be able to access it. The artifact contains no executable implementation and no demonstrated exfiltration endpoint. The vulnerability is therefore unsafe credential collection and handling, not confirmed token theft or remote exfiltration. ### Attack Path 1. A technical-department user requests a Git repository or code operation. 2. Following the skill instructions, the agent asks the user for a username and access token. 3. The user submits the token as plaintext in the conversation. 4. The token is processed and may be retained by the chat platform, model infrastructure, logs, monitoring systems, or conve ...[truncated 895 chars]
• Remediation: ## Remediation Suggestions 1. Remove all instructions asking users to paste tokens into chat. 2. Use an approved OAuth or application-based repository integration with an authenticated consent flow. 3. If direct credentials are unavoidable, collect them through a dedicated secret-entry interface that prevents inclusion in model context, chat history, telemetry, and logs. 4. Store credentials only in an approved encrypted secret manager and provide the agent with an opaque credential reference rather than the secret value. 5. Require short-lived, repository-scoped, least-privilege credentials. Do not accept broad personal access tokens. 6. Apply automatic secret redaction to input, output, traces, crash reports, and audit logs. 7. Delete transient credentials immediately after the authorized operation and document revocation procedures. 8. Require explicit confirmation of the repository, operation, and affected branch before any write. 9. Enforce branch protection, review requirements, and server-side authorization independently of the agent. 10. Treat any token already submitted through conversation as exposed and revoke or rotate it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes very broad greetings and help phrases such as "你好", "hi|hello|hey", and "^帮助$", which can cause the skill to activate in many unrelated conversations. In a skill that introduces system capabilities and operational guidance, unintended activation can confuse users, hijack routing from more specific skills, and increase exposure of sensitive guidance such as repository and access instructions.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly asks users to provide a Git username and token to the assistant for repository operations, without any warning not to paste secrets into chat or any secure credential-handling mechanism. This creates a direct secret exfiltration and misuse risk because chat-visible tokens may be logged, retained, or accessed by unintended parties or downstream systems.

Ssd 3

High

• Confidence: 100% confidence
• Finding: The skill directs technical staff to hand over their personal Git token so the assistant can perform repository actions on their behalf. In this context, that is especially dangerous because the skill also advertises code-writing and Git operations, making secret submission operationally normalized and increasing the chance of credential theft, privilege abuse, repository compromise, or unauthorized code changes.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The instruction "本公司使用辉火云企业套件（不说 'Odoo'）" imposes a fixed terminology choice in natural language. This is a language/wording constraint presented as a mandatory rule, with no user opt-in or documented justification such as compliance or region-specific policy.

Static analysis

No suspicious patterns detected.