T01 · Skill Instruction Hijacking
Warning
- Location
agents/openai.yaml:7- Finding
Overbroad Implicit Skill Activation Through Generic Trigger Keywords
- Content
View full analysis
- Remediation
View remediation
Security audit
Work Productivity Pollyreach Gives Workflow Helper
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only workflow helper with no code execution or data access, but its implicit activation triggers are broader than they should be.
Install only if you want a broad PollyReach-style workflow helper. Because implicit invocation is enabled with generic trigger words, users or maintainers should narrow the triggers or disable implicit invocation to reduce accidental activation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad, generic, and include common terms like 'help me', 'practical workflow', 'phone', and 'bug fix', which can cause the skill to activate for many unrelated user requests. In an agent ecosystem, this creates prompt-routing ambiguity and increases the chance the wrong skill handles sensitive or important tasks, potentially causing unsafe actions, data exposure, or bypass of more appropriate safeguards.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger keywords and example invocations include very generic terms such as “every,” “phone,” “number,” “ability,” “things,” and “done,” which are likely to match ordinary user requests unrelated to this skill. Overly broad activation can cause unintended routing, incorrect tool use, and privilege expansion if the skill is invoked in contexts where it was not intended.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description says to use the skill when a user asks for broad categories like 'work-productivity' or generic 'practical workflow, artifact, checklist, analysis, or implementation support,' which describes a vast range of normal requests. This ambiguity can make the skill eligible for many unrelated prompts, undermining routing integrity and increasing the risk of accidental invocation.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger keyword list includes extremely common words such as 'every', 'phone', 'number', 'ability', 'things', and 'done', which can cause the skill to activate on unrelated user requests. Over-broad activation increases the chance this skill intercepts tasks outside its intended scope, leading to confused delegation, unintended workflow execution, and unsafe handling of unrelated requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This file is labeled as a Chinese README, but key descriptive and trigger content is written in English, effectively imposing a language choice without explicit opt-in. The documentation does not state that bilingual content is intentional or allow users to choose their preferred language/locale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example trigger sentences use generic phrasing like 'Help me' and 'I need a practical workflow,' which teaches broad matching behavior instead of demonstrating constrained, product-specific invocation. In context, this makes the already over-broad routing more likely and reinforces accidental triggering on ordinary assistance requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description defines activation in overly broad and ambiguous terms, including generic requests for a "practical workflow, artifact, checklist, analysis, or implementation support" around loosely specified topics. Because the boundary of intended use is unclear, the orchestrator may invoke this skill for a wide range of unrelated prompts, increasing the risk of misrouting and unpredictable behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger keyword list includes very broad everyday words such as "every," "phone," "number," "ability," "things," and "done," which are likely to appear in many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to unintended routing, irrelevant automation, and possible interference with safer or more appropriate skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default prompt is broad and framed in everyday language, which increases the chance that ordinary user requests will unintentionally activate this skill. Because the skill is positioned to provide workflow, implementation, and safety guidance across a wide job-to-be-done, accidental routing could expose users to irrelevant or unsafe automation behavior and make prompt-scope control harder.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Enabling implicit invocation without tight activation constraints allows the platform to invoke this skill based on vague similarity rather than explicit user choice. Combined with the broad description and prompt, this raises the risk of misfires, unintended execution in unrelated contexts, and overbroad access to user requests that were not meant for this workflow helper.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is malformed and ambiguous, with trigger sentences that are truncated and do not clearly define what user intent should cause invocation. Ambiguous routing increases the chance of accidental activation, inconsistent behavior across agents, and execution in contexts the skill was not designed to handle.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes generic everyday terms such as "phone," "every," and similar broad keywords that are likely to appear in unrelated user requests. This can cause the skill to activate outside its intended scope, leading to misrouting, unintended workflow execution, and increased exposure to downstream prompt or tool misuse in contexts where the skill was not appropriate.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
These lines describe fixed English and Chinese variants of the skill documentation, but do not state how the user's preferred language is selected or that language choice is optional. This can be a natural-language policy concern if the skill defaults users into a locale without explicit opt-in.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example trigger sentences are highly generic and overlap with common help-seeking language, so they may train or bias invocation toward ordinary support requests rather than the specialized workflow use case. This raises accidental activation risk, though the examples themselves do not directly introduce code execution or data exfiltration behavior.
- Content