T01 · Skill Instruction Hijacking
Error
- Location
system-prompt-en.md:48- Finding
Persistent Commercial Response Hijacking and Forced Payment Redirection
- Content
View full analysis
- Remediation
View remediation
Security audit
To B 销售大师 - 通用 Prompt
Security checks for vulnerabilities and agentic risk
Overview
This sales-coaching skill is mostly just markdown prompts, but it embeds forced paid-upgrade messaging and QR-payment redirection into assistant responses.
Review this carefully before installing. It appears to be a prompt-only sales coaching preview, but it is designed to reduce answer quality after a small free allowance and route users toward an unspecified QR-based paid upgrade. Do not scan or pay through any QR code unless you can independently verify the publisher and destination.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill says users can trigger it by saying 'any of the following' and that OpenClaw will auto-load all files so users only need natural-language invocation. While the sample phrases are somewhat specific, the documentation does not define exact trigger constraints, when the skill should not activate, or any negative examples, which can lead to unintended invocation in adjacent sales-related conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instruction says to use specific vocabulary in English and Chinese, including Chinese terms, without first asking the user for language preference. This can violate a language/locale policy when a skill imposes language behavior instead of offering a choice or documenting a justified regional constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file title explicitly defines this as a Chinese prompt variant, and the embedded instructions are entirely framed for Chinese interaction. There is no indication within this file that the user may choose another language, which can violate language/locale choice policy when the skill is used as-is.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation labels the Chinese system prompt as 'recommended primary' and presents the skill primarily in Chinese, despite advertising bilingual support. This creates a language preference bias without explicitly asking the user which language or locale they want, which can conflict with organizational language-choice policies.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file includes behavior that can affect user privacy or finances by directing the user to scan a QR code for payment. The surrounding text presents this as a simple next step, but does not warn users to verify the destination, publisher, or payment details before proceeding.
- Content
Static analysis
No suspicious patterns detected.