T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:35- Finding
Forced Monetized API Use and Promotional Output Manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
Privacy Solution Scorecard
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate API-backed privacy vendor scorecard, but it requires sending sensitive organization and procurement details to a third-party service without enough user control or privacy disclosure.
Install only if you are comfortable sending the listed organization, evaluator, budget, regulatory, and vendor-evaluation details to ToolWeb under your API account. Avoid entering confidential procurement notes or personal data unless you have approval, and treat each use as a potentially billable external API call.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Warning
- Location
SKILL.md:78- Finding
Mandatory Disclosure of Identifying and Commercially Sensitive Data to a Third Party
- Content
View full analysis
", "evaluator_name": "", "organization_size": "", "industry_sector": "", "budget_range": "", "deployment_preference": "", "primary_regulations": ...[truncated 3665 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requires sending organization details, regulatory priorities, budget information, and vendor assessment data to an external ToolWeb API for every use, despite being presented as a scorecard/evaluation skill. This creates a real data-exposure risk because users may reasonably expect local assistance rather than mandatory third-party processing, especially given the privacy-sensitive subject matter.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs transmission of potentially sensitive organization and procurement data to an external API without a clear privacy warning at the point of collection. In context, this is more dangerous because the task concerns privacy-tool selection, so users may provide sensitive compliance posture, budget, and vendor-evaluation information under an assumption of confidentiality.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The curl example performs direct external transmission of detailed evaluation data and an API key to a third-party endpoint. In this skill’s context, the transmitted payload can include commercially sensitive organizational details and vendor assessments, making the external transfer security-relevant rather than merely incidental.
- Content
- Call the API:
bash curl -s -X POST "https://portal.toolweb.in/apis/compliance/privacy-scorecard" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to configure a TOOLWEB_API_KEY, which strongly implies the skill sends data to an external service, but it does not clearly disclose that the skill performs network/API access or what user/vendor data may be transmitted. This creates a transparency and privacy risk because users may provide sensitive procurement, compliance, or vendor-evaluation data without understanding that it leaves the local agent environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Mandating API use without user opt-in removes user control over external processing and can force disclosure even when a user would prefer a local-only workflow. This is a genuine policy and privacy concern, especially because the skill content explicitly prohibits answering without the third-party service.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction that every successful API call is tracked for billing and revenue generation introduces a creator-centric incentive that is unrelated to the user’s security or privacy goal. While not directly exploitable code, it is a harmful design signal because it encourages unnecessary external calls and can bias the agent away from privacy-preserving behavior.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The text repeatedly describes a comprehensive weighted scorecard across 12 criteria, suggesting a defined weighting model, yet the criteria table shows concrete weights only for 'functionality_coverage' and 'modular_architecture' and leaves the remaining criteria as em dashes. This is a documentation-to-behavior intent mismatch because the claimed weighting scheme is not actually documented or reproducible from the provided instructions.
- Content