USA Business Migration Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 0.20260729.110214

Overview

This skill is not destructive, but its name, purpose, and automatic activation rules are mismatched enough that users should review it before installing.

Install only if you are comfortable with a skill whose published name does not match its actual battery-efficiency workflow. Before use, the publisher should align the name and documentation, disable or tightly scope implicit invocation, and remove generic trigger words that can match ordinary conversation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: agents/openai.yaml:6

Finding

Overly Broad Implicit Skill Activation Can Redirect Unrelated Requests

Content

View full analysis

Vulnerability Details

File Location: agents/openai.yaml:6-7, SKILL.md:3-4, and SKILL.md:42-50
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

agents/openai.yaml:6-7:

yaml

policy:
  allow_implicit_invocation: true

SKILL.md:3-4:

yaml

description: >-
  Help users with Validated demand: People repeatedly need a practical, repeatable way to handle Optimizer Battery Efficiency. This requirement is supported by 12 separate online signals across 3 source families, so it represents broader demand rather than a single isolated request.. Use when a user asks for general-help, optimizer, battery, efficiency, would, or needs a practical workflow, artifact, checklist, analysis, or implementation support for this requirement.

SKILL.md:42-50:

markdown

## Triggers

Keywords: `general-help`, `optimizer`, `battery`, `efficiency`, `would`, `suggest`, `now`

Example trigger sentences:

- `Help me People repeatedly need a practical, repeatable way to handle Optimizer Battery Efficiency.`
- `I need a practical workflow for People repeatedly need a practical, repeatable way to handle Optimizer Battery Efficiency.`
- `Use $usa-business-migration-planner to handle People repeatedly need a practical, repeatable way to handle Optimizer Battery Efficiency.`

The localized skill file, SKILL.zh-CN.md:3-4 and SKILL.zh-CN.md:42-50, mirrors the same implicit activation conditions.

Technical Analysis

The Agent configuration permits implicit invocation while the Skill declares generic trigger terms such as would, suggest, and now. These words occur frequently in conversations that have no connection to battery optimization. Consequently, normal user requests may activate the Skill without an explicit request to use it.

Once activated, the Skill instructs the Agent to frame the task around “Optimizer Battery Efficiency” and fo ...[truncated 2038 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable implicit activation unless automatic invocation is strictly necessary:

   yaml

   policy:
     allow_implicit_invocation: false
   

2. Remove generic trigger terms including would, suggest, now, and general-help.

3. Use narrowly scoped phrases such as battery optimizer efficiency, EV battery optimization, or another term that uniquely identifies the supported domain.

4. Require explicit Skill invocation before generating code changes, files, or other artifacts.

5. Rename the Skill and its display metadata so that the name accurately communicates its battery-efficiency purpose.

6. Keep the English and localized Skill definitions synchronized so that neither version reintroduces broad triggers.

7. Add activation tests confirming that unrelated prompts containing common conversational words do not invoke the Skill.

8. Add positive tests confirming that explicit, domain-specific battery optimization requests continue to invoke it correctly.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README presents a skill named 'USA Business Migration Planner' but almost all of the actual content, triggers, and evidence concern an unrelated 'Optimizer Battery Efficiency' general-help workflow. This mismatch can cause the wrong skill to activate or be selected under false pretenses, undermining user trust and creating a prompt-routing integrity problem where users may unknowingly invoke behavior outside the advertised scope.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are broad and generic enough to match ordinary user requests, including common help-seeking language unrelated to the named skill. In a skill-based agent system, this can cause overbroad invocation, accidental interception of unrelated conversations, and unexpected application of instructions that the user did not intend to invoke.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented trigger keywords and phrases are overly generic (for example, words like 'would', 'suggest', 'now', and 'general-help'), making accidental invocation likely during normal conversation. In an agent ecosystem, broad matching can cause the wrong skill to activate, leading to context hijacking, irrelevant instructions being inserted, or unintended processing of user requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata and title present this as a 'USA Business Migration Planner,' but the body describes an unrelated 'Optimizer Battery Efficiency' workflow. This mismatch can cause unintended routing, user confusion, and misuse of the skill in contexts it was not designed for, which is a security-relevant integrity issue because users and orchestrators may trust the declared scope.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The invocation description says to use the skill for broad categories like 'general-help' and generic implementation support, without clear scope boundaries. Ambiguous activation conditions increase the chance that orchestration systems or users apply this skill outside its intended context, causing misrouting and potentially unsafe assistance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The in-file title contradicts the requirement text and trigger behavior, indicating the skill may have been assembled from inconsistent or copied components. Contradictory identity and purpose weaken operator review and can lead to accidental invocation in the wrong domain, producing unsafe or misleading outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Trigger keywords such as 'general-help,' 'would,' 'now,' and other common terms are so broad that the skill could activate during ordinary conversation unrelated to its intended purpose. Overbroad activation is dangerous because it can hijack routing, suppress more appropriate skills, or inject irrelevant instructions into unrelated tasks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill’s declared identity ('USA Business Migration Planner') does not match its actual behavior, which is about 'Optimizer Battery Efficiency'. This kind of semantic mismatch can cause the wrong skill to be invoked, mislead users and reviewers, and hide the skill’s true purpose during governance or routing, increasing the chance of unauthorized or unintended execution.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is loosely defined and mixes generic categories ('general-help') with weakly bounded topical terms, so it does not clearly restrict when the skill should run. In a skill-routing system, ambiguous activation logic can cause overmatching, unexpected behavior, and policy bypass by drawing unrelated prompts into this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger keywords include extremely broad terms such as 'general-help', 'would', 'suggest', and 'now', which are common in ordinary conversations. That makes accidental activation likely, allowing this skill to intercept unrelated requests and influence responses outside its intended domain.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata says it is a USA business migration planner, but the requirement plan and triggers are for an unrelated optimizer battery efficiency workflow. This mismatch can cause the skill to activate in the wrong contexts, confuse routing and review controls, and make it easier to smuggle behavior past maintainers or users who rely on the title and declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger sentences are excessively broad and include generic phrasing like 'Help me' and 'I need a practical workflow,' which are common across benign user requests. This creates unsafe over-triggering, where the skill may activate outside its intended scope and hijack unrelated conversations or workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The keyword set includes highly generic terms such as 'general-help', 'would', 'suggest', and 'now', which are likely to appear in many unrelated requests. This weak scoping increases the chance of unintended activation and prompt hijacking of benign user interactions, especially given the already inconsistent skill identity in the README.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This file is a Chinese-language user-facing README, but the content does not state that language selection is optional or that the locale is intentionally constrained for a region-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger phrases are vague and resemble normal conversational requests, which normalizes unsafe broad activation behavior. This increases the probability that the skill will be selected unintentionally and trusted for tasks outside its validated scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The sample trigger phrases normalize broad activation patterns like 'Help me' and 'I need a practical workflow', which are common phrasing for many unrelated tasks. These examples encourage implementers or routing logic to accept unsafe, generic matches, increasing accidental invocation and cross-domain interference.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default prompt uses a broad, natural-language activation phrase tied to common words like 'help' and generic workflow requests, which can cause the skill to be invoked unintentionally. This increases the risk of prompt-routing hijacks or inappropriate activation in unrelated conversations, especially because the skill description and prompt appear semantically inconsistent, making invocation boundaries unclear.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Enabling implicit invocation without a tightly scoped activation boundary allows the platform to auto-select this skill based on vague user language rather than explicit intent. In this file, that risk is amplified by the generic default prompt and the mismatch between the skill name ('USA Business Migration Planner') and its described function ('Optimizer Battery Efficiency'), which makes accidental or incorrect activation more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The keyword list contains vague terms such as 'general-help,' 'would,' 'suggest,' and 'now,' which are too common to safely scope activation. Such generic keywords increase accidental invocation risk and weaken any policy or routing boundary based on intent matching.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.