T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:482- Finding
Mandatory Commercial Promotion Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Problem-to-Action
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed problem-solving workflow with no code execution or data access, though users should be aware it has broad activation language and a built-in Pro upsell.
Install this only if you are comfortable with a structured 8-step coaching flow that may activate for very broad problem statements and may append a paid Pro-version prompt after the plan. Do not rely on it as a substitute for professional help in medical, legal, financial, crisis, or other high-stakes situations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes the skill as applicable to essentially "any problem" and presents a broad, generic interaction model without clear scope boundaries. This can cause over-triggering for sensitive topics such as mental health, legal, medical, financial, or crisis situations, increasing the chance the agent is invoked where specialized safeguards or routing would be more appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The call to action invites users to "type your problem" with only broad example categories and no activation boundaries. In context, this encourages use for almost any issue and may draw in users with high-stakes or harmful scenarios, making the skill more dangerous because it is framed as a universally applicable action-planning tool rather than a limited coaching aid.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares extremely broad triggers such as '问题', '困难', '挑战', and '不知道怎么办', which are common in ordinary conversation. This can cause the skill to activate unintentionally in many unrelated contexts, steering users into a rigid 8-step workflow and potentially interrupting higher-priority safety or domain-specific handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow start condition says the skill should launch for '任何问题、困境、矛盾', which is overly ambiguous and effectively makes it a catch-all behavior. In practice, this increases the chance of over-triggering on casual statements or sensitive situations where a generic planning framework is inappropriate and may displace safer specialized guidance.
- Content
Static analysis
No suspicious patterns detected.