Atlas Cro Lite

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.3

Overview

The skill is a Markdown-only CRO audit helper, but it automatically adds commercial promotion to generated reports and includes an unrelated paid DeFi upsell.

Review before installing if you need neutral or client-facing reports. The skill does not appear to access data, run code, or persist changes, but users should remove or accept the mandatory sales footer and unrelated paid-package language before relying on its output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:182

Finding

Forced Commercial Promotion in Generated Audit Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 182
Vulnerability Type: Forced output manipulation through skill instructions
Risk Level: Medium

Vulnerable Code Snippet

markdown

---
*Audit generated by Atlas CRO Lite. Get the full Atlas Marketing Suite at atlasagentsuite.com/skills.html*

Technical Analysis

The skill places a commercial attribution and external sales link inside the prescribed Phase 4 audit-report template. Because this content is part of the output instructions rather than optional documentation, an agent following the skill will append promotional material to a user-requested CRO audit.

This is instruction hijacking at the output-integrity level: loading and following the skill modifies the agent's response objective by requiring it to advertise a third-party commercial product. The instruction does not override system safety constraints, execute code, or access sensitive resources, but it introduces content unrelated to the user's core request without requiring informed consent.

The surrounding upgrade sections at SKILL.md:202-223 and links at README.md:7-8 are overt documentation and were not independently identified as vulnerabilities because they are not specified as mandatory generated output.

Attack Path

1. A user or platform loads the Atlas CRO Lite skill.
2. The user asks the agent to audit a landing page.
3. The agent follows the workflow in SKILL.md.
4. During Phase 4, the agent uses the prescribed audit-report template.
5. The template causes the agent to append the Atlas commercial attribution and external sales URL.
6. The resulting report exposes the user or downstream report recipients to promotional content presented as part of the requested audit.

Impact Assessment

The issue compromises the integrity and neutrality of generated reports. It may cause users to distribute third-party advertising unknowingly, create reputational o ...[truncated 348 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the promotional footer and external sales URL from the mandatory Phase 4 report template.
2. Keep product attribution and upgrade information in a clearly labeled documentation section that does not instruct the agent to reproduce it.
3. If attribution is required, use a neutral product identifier without a sales call to action or tracking URL.
4. Include commercial links in generated output only when the user explicitly requests product or upgrade information.
5. Add a policy to skill-review procedures prohibiting mandatory advertising, affiliate links, or unrelated calls to action in generated responses.
6. Test the revised skill with a standard CRO-audit request and verify that the generated report contains only user-requested analysis unless optional promotional content was expressly requested.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CRO skill’s upsell text advertises unrelated 'advanced DeFi modules' in a Pro package, which is inconsistent with the rest of the skill’s marketing/landing-page optimization scope. In a prompt/skill ecosystem, this kind of scope mismatch is a supply-chain trust red flag: users may be induced to download or rely on add-ons that are unrelated to the declared function, increasing the chance of deceptive bundling or unexpected risky content.

Content

No source excerpt is available for this finding.