T01 · Skill Instruction Hijacking
Error
- Location
references/output-format.md:13- Finding
Mandatory Promotional Content and Third-Party Resources in Generated Reports
- Content
- Remediation
View remediation
Security audit
卓钢链黑色产研院的早报工具
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly generates the advertised report, but it also forces branded/promotional content and third-party remote resources into the HTML without clear user control.
Review before installing. Use it only if you are comfortable with default web fetching, generated HTML files on the desktop, automatic opening for screenshots, omitted source labels, and mandatory branded footer/link content. Remove or neutralize the external links and remote images if the report will be shared or opened in a browser.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: futures-morning-brief description: 期货早报生成工具。用户输入网址或留空默认使用西本资讯，自动抓取当天最新行业要闻早餐，按固定HTML格式输出，包含：整体综述（置顶）、重点关注（3条）、信息速览（行情表格）、宏观要闻（10条+详情）、产业要闻（6条+详情）。触发词：生成早报、期货早报、早间新闻、行业要闻早餐、早班车、卓钢早报。 ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises automatic retrieval of the latest external content and HTML page generation, but does not warn users that the skill may access third-party sites or create output files/artifacts. This reduces informed consent and can surprise users with network activity, unreviewed content ingestion, or generated HTML that may later be rendered in a browser.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include broad, common expressions such as '生成早报' and '早间新闻', which could activate the skill during ordinary conversation without clear user intent. In a skill that performs web fetching and generates output artifacts, accidental invocation can cause unexpected external access and content generation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states the tool only reformats user-provided content, but earlier text says leaving the input blank causes the skill to automatically fetch from a default external source. That is a material mismatch in documented behavior that can mislead users about network access, provenance, and copyright/privacy implications, increasing the chance of unintended external requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very generic terms such as '生成早报', '早间新闻', and '早班车', which are likely to match ordinary user conversation and invoke the skill unexpectedly. Overbroad activation can cause unintended execution of network access and file-writing behavior without the user clearly intending to use this specific skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs saving generated HTML directly to the user's desktop and then opening it for screenshot verification, without explicit user confirmation. Writing files to a sensitive, user-visible location and opening them automatically can create privacy, integrity, and consent issues, especially if the content includes untrusted data pulled from external sites.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The title and formatting instructions are entirely specified in Chinese, framing the required output as a Chinese-language report format. Because there is no indication that the user can choose another language or that this is a justified region-specific constraint, this can be read as forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README presents the tool entirely in Chinese and describes output optimized for Chinese typography, but it does not state that language selection is optional or limited to a justified region-specific use case. This can indicate a locale policy issue if the skill defaults to or requires Chinese output without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill automatically fetches content from a default external site when the user does not provide a URL, but it does not warn the user that network access will occur. This reduces transparency and can expose user environment metadata or cause unintended interaction with remote content.
- Content
Static analysis
No suspicious patterns detected.