T07 · Tool Hijacking and Spoofing
Warning
- Location
SKILL.md:40- Finding
Relative Execution of Absent and Unverified PowerShell Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
工作目录健康检测
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate workspace-repair purpose, but its repair instructions rely on unbundled PowerShell scripts and ambiguous relative execution paths for actions that can delete directories and change configuration.
Review this skill before installing or using it. Only run the referenced PowerShell scripts if you can verify their exact source and contents, prefer the documented dry-run first, back up affected configuration and directories, and do not run the DryRun:false repair unless the exact paths to be deleted or changed are shown and confirmed.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes very broad phrases such as '工作目录异常', 'workspace问题', and command-like terms that may appear in ordinary user troubleshooting conversations. This can cause the skill to activate outside narrowly intended scenarios, increasing the chance that it handles unrelated contexts or performs workspace-affecting actions when not explicitly requested.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill activates on relatively broad workspace-related keywords without clear scope constraints, which can cause it to trigger in contexts where the user is only discussing the problem rather than requesting filesystem inspection or repair. Because the skill includes destructive remediation actions such as deleting nested directories, overbroad activation increases the chance of unintended operational impact if the agent proceeds too quickly.
- Content