T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:414- Finding
Hard-Coded Promotional Contact Information Injected into Generated Presentations
- Content
View full analysis
- Remediation
View remediation
Security audit
study-abroad-advisor
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a study-abroad advice skill, but its PPT mode can insert the author’s WeChat contact into user-facing presentations without clear user consent.
Before installing, review the PPT-generation behavior carefully. Remove or replace the hard-coded WeChat/contact page unless you explicitly want that contact information in generated presentations, and prefer requiring confirmation before invoking pptx or producing shareable files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
L310-L316 对语气、句式和禁忌做了强约束，且整个技能文档以中文表述，没有看到向用户提供语言或本地化选择的说明。对于面向多国家申请场景的技能，这种默认固定语言/表达规范可能构成未获用户选择的语言偏好限制。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation keywords are extremely broad terms like '留学', '选校', and '文书', which can appear in ordinary conversation and unintentionally trigger the skill outside a clearly bounded invocation context. This increases the chance of unsolicited behavior, context hijacking, or the skill taking over responses when the user did not explicitly request it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The PPT-generation trigger is defined by vague phrases like '生成PPT' or '输出方案' with automatic tool invocation, but it does not constrain topic, content source, or require confirmation before calling the pptx capability. This can cause unintended file generation, overbroad tool use, or trigger abuse from ambiguous user prompts that merely discuss presentations rather than request execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill file is written in Chinese and does not indicate that other languages are supported or that the user can choose their preferred language. Under the language/locale policy, fixed language behavior without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is written entirely in Chinese and presents the methodology as the default instructional format, with no indication that users may choose another language or that the locale is required for a region-specific purpose. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructional content solely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all instructional content in a single language, which can amount to a language/locale policy issue when no user opt-in or alternative language option is provided. The document does not state that it is intended only for a Chinese-speaking audience or region-specific use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance exclusively in Chinese and does not mention any user opt-in, alternative language availability, or region-specific justification for the language constraint.
- Content