Back to skill

Security audit

USA Business Migration Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to be a USA business migration planner, but its actual instructions and triggers steer users toward an unrelated Codex/API relay promotion.

Review this skill carefully before installing. It appears to be mislabeled and may activate during ordinary API, Codex, token, or Pro-related conversations to steer the assistant toward an unrelated relay-service promotion. I did not find executable code or persistence, but the routing and disclosure problems are enough to require review.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:4
Finding

Implicit Invocation Redirects Unrelated Requests Toward Promotional Content

Content
View full analysis
- Help users with Validated demand: People repeatedly need a practical, repeatable way to handle [opening promotion] a relay service built with colleagues, offering a Codex Pro pool at 0.4x pricing and a registration bonus worth approximately 2.5 million tokens. This requirement is supported by 12 separate online signals across 3 source families, so it represents broader demand rather than a single isolated request. Use when a user asks for software-and-data, v2ex, promotions, codex, pro, or needs a practical workflow, artifact, checklist, analysis, or implementation support for this requirement. ``` `SKILL.md:44-50`: ```markdown Keywords: `software-and-data`, `v2ex`, `promotions`, `codex`, `pro`, `token`, `api` Example trigger sentences: - `Help me People repeatedly need a practical, repeatable way to handle [opening promotion] a relay service built with colleagues, offering a Codex Pro pool at 0.4x pricing and a registration bonus worth approximately 2.5 million tokens.` - `I need a practical workflow for People repeatedly need a practical, repeatable way to handle [opening promotion] a relay service built with colleagues, offering a Codex Pro pool at 0.4x pricing and a registration bonus worth approximately 2.5 million tokens.` - `Use $usa-business-migration-planner to handle People repeatedly need a practical, repeatable way to handle [opening promotion] a relay service built with colleagues, offering a Codex Pro pool at 0.4x pricing and a registration bonus worth approximately 2.5 million tokens.` ``` `agents/openai.yaml:3-7`: ```yaml default_prompt: "Use $usa-business-migration-planner to help me People repeatedly need a practical, repeatable way to handle [opening promotion] a relay service built with c ...[truncated 3232 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The README brands the skill as a 'USA Business Migration Planner,' but the actual content centers on V2EX/Codex promotional material and token/API intermediary offers. This identity mismatch can mislead users, routing systems, or reviewers into invoking or approving the skill for the wrong purpose, which increases the chance of social-engineering abuse and policy evasion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description claims help for a USA business migration planner but actually targets unrelated promotion/Codex/token topics, indicating intentional mislabeling. In skill ecosystems, this can bypass human review, confuse routing logic, and surface untrusted content when users ask about ordinary business tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation description uses vague criteria such as 'needs a practical workflow, artifact, checklist, analysis, or implementation support,' which applies to a huge share of normal assistant tasks. This ambiguity makes accidental activation likely and increases the chance that irrelevant or risky instructions are injected into unrelated user sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill presents itself as a 'USA Business Migration Planner' while its manifest and body actually promote an unrelated Codex/proxy/promotion workflow. This deceptive mismatch can cause the orchestrator or user to invoke the skill in the wrong context, enabling covert behavior, traffic diversion, or policy evasion under an innocuous title.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keywords are overly broad and include common terms like 'api', 'pro', and 'token', which can match many unrelated user requests. This creates prompt-hijacking risk by causing the skill to activate outside its intended scope and inject unrelated or promotional instructions into benign conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keywords are overly broad and include generic technical terms like "api", "token", "pro", and "software-and-data", which can match many unrelated conversations. This creates a prompt-routing risk where the wrong skill activates and injects irrelevant or policy-bypassing content into normal user interactions, especially given the skill also contains suspicious promotional text unrelated to its stated business-planning purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata and manifest framing claim a USA business migration planning capability, but the actual requirement content pivots to V2EX/Codex promotion and token-related workflows. This mismatch is dangerous because it can bypass user and platform expectations, enable deceptive routing or hidden promotion behavior, and cause the skill to activate in contexts unrelated to its declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The usage signals and trigger sentences are tuned to attract requests about promotions, Codex Pro pools, tokens, and API usage rather than the declared migration-planning domain. In context, this looks like covert repurposing of the skill into a promotional or traffic-capture mechanism, which can mislead users and downstream agents into invoking functionality they did not intend to use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The user-facing README is primarily in English but embeds Chinese promotional text in the core requirement statement without offering a language choice or explaining a locale-specific constraint. This can violate language/locale policy expectations because the skill appears to force mixed-language content on users without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad and conversational, making it easier for unrelated user requests to activate this skill without clear consent or scope matching. In the context of a misleadingly branded skill, overly permissive triggers raise the risk of accidental invocation and unwanted redirection toward unrelated promotional/API-token content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad and include generic terms like "software-and-data", "v2ex", "promotions", "codex", "pro", "token", and "api", which can cause the skill to activate in contexts far beyond its stated purpose. Overbroad activation increases the chance of unintended invocation, context hijacking, or routing users into a skill built around promotional/token-reseller content that may be untrusted or policy-sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description embeds Chinese-language promotional text inside an otherwise English skill description, and the same mixed-language content is repeated elsewhere. This imposes a language/locale assumption without user opt-in or explanation, which can violate language-choice policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example triggers are generic repetitions of the same broad phrasing and provide no negative examples or constraints, which reinforces over-activation. While less severe than hidden code execution, this still increases the chance of inappropriate routing and exposure to misleading promotional content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description defines invocation conditions vaguely and mixes an unrelated promotional message with the supposed use case, making the intended scope unclear. Ambiguous routing criteria increase the chance of accidental invocation and can be used to surface untrusted or manipulative content in contexts where the skill does not belong.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The default prompt is extremely broad and includes unrelated promotional and mixed-language content, which can cause the skill to activate in response to loosely related user requests. This increases the chance of misrouting conversations, surfacing spam-like content, or injecting untrusted marketplace/promotion text into otherwise unrelated workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Enabling implicit invocation without tight trigger constraints allows the agent platform to call this skill based on vague keyword overlap rather than clear user intent. In this case, the metadata already contains broad and promotional terms, so implicit invocation amplifies the risk of unsolicited activation and inappropriate insertion of potentially adversarial content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase is broad enough to overlap with ordinary user requests, increasing the chance of accidental invocation. When combined with the deceptive domain mismatch in this skill, ambiguous triggering becomes more dangerous because it can silently route benign conversations into unrelated promotional behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger description uses a generic request pattern without clear constraints, so normal conversation could satisfy the activation condition. In this skill’s context, that ambiguity raises the risk of unintentional activation of a mislabeled or repurposed workflow, amplifying confusion and possible abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This Chinese-language README includes core usage guidance and trigger phrases in English, but does not state that users may choose their preferred language or that English is required for a justified reason. That can amount to an implicit language policy constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest mixes English with Chinese promotional copy and pricing/token claims without any documented locale or consent rationale. While not inherently exploitable on its own, this is dangerous in context because it signals the skill may be carrying advertising or irrelevant third-party content into user interactions, undermining trust and increasing prompt-routing confusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The requirement text embeds Chinese promotional language directly into the core skill description, and the same wording is repeated in trigger examples. There is no indication that the skill offers a language choice or that the locale-specific content is required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.