T01 · Skill Instruction Hijacking
Error
- Location
system-prompt-en.md:48- Finding
Forced Commercial Output Injection and QR-Based Payment Redirection
- Content
View full analysis
- Remediation
View remediation
Security audit
To B 销售大师免费陪练/Free coaching from top B sales experts
Security checks for vulnerabilities and agentic risk
Overview
This sales-coaching skill is mostly just prompt text, but it deliberately limits help after two questions and pushes users toward an unverified QR-code payment path.
Review this skill before installing if you do not want agent responses to be throttled or to include unsolicited upgrade prompts. The missing QR payment asset means the payment destination cannot be verified from this package.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file states that the Chinese system prompt is the recommended primary option while the English prompt is secondary, and the examples and overall instructions are presented only in Chinese. This creates a language preference that is not presented as an explicit user choice, which can conflict with language/locale policy expectations requiring opt-in or neutral selection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction says to mirror buyer vocabulary specifically in English and Chinese, which imposes language behavior in the prompt without explicit user opt-in. Under the policy criteria, forcing a specific language or locale is a natural-language policy concern unless the skill offers a language choice or clearly justifies the constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file title explicitly labels the prompt as Chinese-only, and the embedded prompt instructs the model to respond in that preset style without offering an alternative language or asking the user for preference. This is a natural-language locale policy issue because it hard-codes a language constraint rather than making language selection user-driven.
- Content