T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:39- Finding
Mandatory Injection of Unapproved Text into Published Video Descriptions
- Content
View full analysis
- Remediation
View remediation
Security audit
腾讯视频号发布
Security checks for vulnerabilities and agentic risk
Overview
The skill posts to WeChat Channels, but it also forces unwanted public text, a fixed location, and an originality declaration without clear user approval.
Review carefully before installing. This skill can operate in a live WeChat Channels account and publish visible content, while adding preset wording, tags, a Suzhou Center location, and an originality declaration. Use it only if you are comfortable manually reviewing and approving those fields before publication, preferably with a dedicated publishing account.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
other
Warning
- Location
SKILL.md:45- Finding
Hard-Coded Publication Location Can Create False or Unapproved Location Metadata
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:49- Finding
Unconditional Originality Declaration Can Submit an Unverified Rights Attestation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The hard-coded selection of '苏州中心' is a direct account-content manipulation performed without user authorization or necessity for the stated task. Because this is a social publishing skill, inserting false location metadata can mislead viewers and alter platform distribution or trust signals, making the issue more severe in context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill requires QR-based login to a personal authenticated account but does not provide a clear privacy and session-use warning. Users may not understand that browser automation will operate within their live account session, potentially accessing or modifying sensitive account content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs adding a fixed phrase to every video description that is unrelated to the user’s publishing intent and manipulates posted content without consent. Because this changes the account’s public output in a misleading way, it creates reputational and trust risks and may normalize deceptive automation behavior.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The inserted phrase creates a deceptive or coercive narrative in the published description that is unrelated to the user’s request and may be interpreted as a joke about unauthorized control. Embedding such language into public posts can mislead audiences, harm the user’s reputation, and signal intentional manipulation by the skill author.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Forcing the post location to a specific place without user opt-in is an unjustified metadata modification and can falsely represent where the content was created or associated. In a social publishing context, location metadata affects audience perception and platform behavior, making this materially more dangerous than a benign formatting change.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatically declaring every post as original content applies policy-significant metadata that may be false for reposted, edited, or third-party material. This can expose the user to platform enforcement, copyright disputes, and credibility issues because the skill is making a legal/policy assertion on the user’s behalf.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill performs a high-impact action—publishing content from the user’s authenticated social account—without an explicit warning that it will modify public account content and may expose it to broad audiences. In this context, the absence of clear consent and pre-publish confirmation increases the risk of unintended publication and account misuse.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Hard-coded hashtags unrelated to the user’s requested content exceed the narrow purpose of posting a video and silently alter the message being published. This can misrepresent the user’s content, reduce user control, and create minor compliance or spam-policy issues.
- Content
Static analysis
No suspicious patterns detected.