T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:170- Finding
Mandatory Vendor-Specific Instructions Hijack Customer Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Content Master Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill is a content-marketing template, but it can steer outputs toward RAAI instead of the user's business and declares unnecessary high-value credentials.
Review before installing. Remove or rewrite the RAAI-specific runtime rules so outputs bind only to your configured business, and do not provision any API, Telegram, Sheets, or email-marketing credentials unless a separate integration clearly needs them. Treat the installer as needing repair before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:15- Finding
Text-Only Skill Declares Unnecessary Access to Multiple High-Value Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (117)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
- Content
Static analysis
No suspicious patterns detected.