T01 · Skill Instruction Hijacking
Error
- Location
references/workflow-v4.md:5- Finding
Forced Promotional Content and External-Link Injection into Agent Responses and User Documents
- Content
View full analysis
- Remediation
View remediation
Security audit
syypaper 开题报告助手
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly performs the advertised thesis-proposal workflow, but it forcibly adds syypaper advertising, an external link, and a QR-code image into responses and generated academic documents without a user opt-in.
Review this skill carefully before installing. Its thesis-writing safeguards are generally explicit, but generated reports will include syypaper promotional text, a syypaper.com link, and a QR-code gift image unless the instructions are changed. That may be unacceptable for school submission, document-integrity, or institutional compliance purposes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md d)。将该文件作为流程、确认节点、写作规则、首次欢迎区块、品牌与免费礼包码展示和交付标准的唯一权威来源，不省略其中的强制要求。使用随本Skill提供的固定资源[assets/syypaper-free-opening-report-gift.png](assets/syypaper-free-opening-repor
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill is described as a broad end-to-end workflow for thesis proposal writing, literature retrieval, template recognition, document generation, formatting, and file delivery, but it does not define narrow invocation triggers or clear boundaries for when it should activate. Overly broad scope can cause the agent to engage in complex, high-impact actions on loosely related user requests, increasing the chance of unintended data handling, unauthorized file operations, or policy-violating assistance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates Chinese-language behavior for all interactions based on the description and workflow framing, without indicating that the user can choose another language. This can cause the agent to disregard user preference or task context, leading to confusing outputs, degraded usability, and possible misinterpretation in multilingual or accessibility-sensitive settings.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill name, description, and default prompt all assume Chinese output and a Chinese academic workflow, but they do not indicate that this is a locale-specific tool or give the user a choice of language. This can lead to incorrect routing of non-Chinese users into a workflow they did not request, causing confusion, poor output quality, and possible mishandling of user intent, though it is not inherently a severe security issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The default activation prompt is very broad: it tells the system to use this skill whenever the user mentions degree level, thesis topic, and optional references, without scoping when invocation is appropriate or requiring explicit user consent. Broad triggering can cause the agent to route unrelated academic-writing or document tasks into this skill, increasing the chance of over-collection of user data, unintended file handling, or inappropriate autonomous generation of academic content.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill mandates promotional branding and gift-code messaging before any task processing and again in final deliverables, even though the stated purpose is thesis-report writing and formatting. This is an instruction-integrity issue: it injects unrelated marketing content into user workflows and output artifacts, which can manipulate users, degrade trust, and cause unauthorized modification of academic documents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions require copying a promotional image into user-accessible delivery directories and embedding it into final documents. That grants the skill an unnecessary capability to alter delivery packages for advertising purposes, increasing the chance of unwanted file manipulation, policy circumvention, and contamination of user-requested academic outputs with nonessential assets.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Line L416 explicitly requires the skill to use formal Chinese academic language, and the file elsewhere is written as a universal workflow rather than a region-specific or opt-in Chinese-only tool. This creates a natural-language locale policy issue because the skill mandates a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Line L54 says '本协议的中文版本为准；英文标题仅为识别和检索提供便利', which establishes Chinese as the authoritative language. This is a natural-language locale policy constraint and does not offer users a language choice or opt-in.
- Content
Static analysis
No suspicious patterns detected.