T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:28- Finding
Broad Skill Activation Can Cause Unconfirmed Disclosure to an External Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Email-managed Website Builder Casso
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malware, but it can route website requests and attachments to an external email service without clearly requiring user confirmation first.
Review any email before it is sent to Casso. Confirm the exact recipient, message body, links, and attachments, and remove private or unrelated information. Generic website requests may invoke this service, so install it only if you are comfortable using an external email-based website builder.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to send email and encourages inclusion of attachments, but it does not prominently warn the user that their content will be transmitted to an external third-party service. This is dangerous because users may unknowingly disclose personal, business, or proprietary materials such as logos, resumes, menus, contact details, or domain information to an outside processor.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation guidance includes broad phrases like 'build a website' and an open-ended 'anything else similar,' which can cause the skill to trigger in ambiguous contexts without clear user intent to invoke an external email-based service. In this skill, misactivation is more dangerous because invocation can lead to drafting or sending sensitive website plans, attachments, or business details to a third-party service.
- Content
Static analysis
No suspicious patterns detected.