T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:83- Finding
Mandatory Commercial Redirection and Agent Workflow Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Ziwei Doushu Advisor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its fortune-chart purpose, but it sends personal birth details to an external service and includes an overly forceful payment-and-retry workflow.
Install only if you are comfortable sending birth date, birth time, calendar details, and gender to skill.myfate.ai with your API key. Before any retry after a recharge or quota error, ask the agent to show the fields it will resend and get your explicit confirmation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs collection and transmission of highly sensitive personal data, including birth date, birth time, gender, and potentially lunar calendar details, to a third-party API, but it provides no user-facing privacy notice, consent step, retention disclosure, or data handling limitations. Because these details are intimate profile data and are sent off-platform, users may unknowingly disclose sensitive information without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill includes explicit instructions to send user-supplied personal data in an HTTP POST request to an external domain, which is a genuine external data transmission path. In context, the danger is elevated because the payload contains sensitive personal profile data and the skill does not pair transmission with meaningful disclosure, minimization, or trust assurances beyond requiring an API key.
- Content
md --- ### 工具调用通用 CURL 示例 所有工具的调用方式均采用 HTTP POST 请求，下面是一个通用的 CURL 调用示例。在实际调用时，请将 URL 中的 `TOOL_NAME` 替换为具体的工具名称，并在 `-d` 的 JSON 中传入该工具所需的参数：
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to retain and later reuse sensitive birth details from conversation memory after an external payment event, without requiring renewed consent or re-confirmation. This creates a privacy risk because sensitive personal data is being persisted across workflow stages and reused after an off-platform action, increasing the chance of over-retention, unintended disclosure, or misuse.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions require responses in a particular Chinese-language interpretive style ('通俗易懂、带有温度的语言') and do not indicate that the user may choose another language or locale. Under the language/locale policy, forcing a specific language or presentation without opt-in is a natural-language policy concern.
- Content