T01 · Skill Instruction Hijacking
Error
- Location
hooks/hooks.json:3- Finding
Automatic Session-Wide Persona and Instruction-Priority Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
New Youth.skill | 新青年.skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a coaching prompt, but it includes an automatic session-start hook that could make its persona influence unrelated chats without clear user opt-in.
Review before installing. The content itself is a reflective coaching framework with limited local helper scripts, but a compatible host could load its session-start hook automatically and apply its persona rules to unrelated conversations. Install only if you are comfortable with that behavior or can disable/remove the hook and keep the skill explicitly invoked.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (58)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description presents a broad reflective coaching skill covering personality evaluation, decision support, scrutiny of claims, daily practice, expanded perspective, and translating reflection into action. The actual code only performs a narrow subset: a six-dimension self-assessment with scoring, grading, and canned improvement suggestions. It does not analyze user dilemmas, review arguments or evidence in context, provide dynamic daily exercises, broaden perspectives interactively, or support action execution. There are no hidden resource accesses or suspicious undeclared permissions, but the primary purpose is materially narrower than the declared skill behavior, so this is a description-behavior mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad, natural-language prompts tied to introspection, decision-making, and argument evaluation, but the README provides only a narrow exclusion for deterministic technical tasks. In an agent platform, this can cause the skill to activate on loosely related conversations and inject persuasive guidance outside its intended scope, increasing the chance of unplanned prompt interception or behavioral override.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation criteria are broad, natural-language prompts tied to common self-reflection and critical-thinking questions, which can cause the skill to trigger in ordinary conversation without explicit user intent. In an agent environment, this can unexpectedly steer responses into the skill’s persona and workflow, overriding the user’s desired task framing or causing prompt-surface expansion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation examples are phrased as broad, natural-language self-improvement questions, which increases the chance the skill will trigger during ordinary conversation rather than only on explicit invocation. Unintended activation can override user intent, steer responses into an ideological/personality framework, and create prompt-scope confusion across unrelated tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents usage and activation entirely in Japanese, including the command and trigger phrases, without stating that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in should be flagged unless the locale constraint is clearly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation rules are broad, subjective, and include common reflective phrases without clear exclusions or task boundaries. This can cause the skill to trigger in situations where users did not intend moral/personality guidance, increasing the chance of prompt hijacking of unrelated conversations and inappropriate behavioral steering.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation phrases are broad self-help and reflective prompts that could match ordinary user conversation, causing the skill to engage outside clearly bounded intent. In an agent environment, overbroad triggering can hijack unrelated sessions, steer outputs toward the skill's framing, and override user expectations even without explicit malicious code.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code
bash mkdir -p .claude/skills git clone https://github.com/Moroiser/new-youth-skill.git .claude/skills/new-youth-skill
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
该 README 是 markdown 文件，因此适用 SQP-1。此处将“思想触发”定义为若干自然语言句子，其中如“面对选择，我该如何自处？”和“我想成为一个更有担当的人”属于较常见、开放式的人生/建议表达，且未提供排除条件或边界说明，容易在一般对话中被误判为应激活该技能。
- Content
Static analysis
No suspicious patterns detected.