T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:164- Finding
Automatic Following of Mutable Remote Heartbeat Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
TASD
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent design guide, but it should be reviewed because it encourages downstream agents to persist API keys and follow mutable remote heartbeat instructions without enough safeguards.
Install only if you want a design aid for agent-native services and are prepared to tighten its outputs. Before using generated specs, require secure token storage, restrictive file permissions or a secret store, token rotation, allowlisted domains, signed or schema-limited remote status responses, and explicit human approval for destructive, public, financial, or privacy-sensitive actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:117- Finding
Insufficiently Protected Persistent API-Key Storage Guidance
- Content
View full analysis
/credentials.json` or env var). ``` ### Technical Analysis The Skill requires generated specifications to tell agents how to persist API keys in a JSON file or environment variable, but it does not require secure file creation, restrictive permissions, operating-system secret storage, log redaction, source-control exclusion, or lifecycle controls. Credential persistence is relevant to authenticated service operation, so storing some form of authentication material can be necessary. However, prescribing a plaintext configuration file without mandatory safeguards exceeds the minimum safe handling standard. Environment variables also require care because they may be inherited by child processes or exposed through diagnostic tooling and logs. The issue is not evidence that this repository accesses or exfiltrates an actual credential. It is insecure design guidance that can cause downstream implementations to expose persistent secrets. ### Attack Path 1. A service designer follows the Skill and generates instructions that store an API key in `~/.config//credentials.json`. 2. An agent creates the file using default permissions or in a directory accessible to other local principals. 3. The credential is copied into a backup, diagnostic bundle, log, or source repository, or is read by another local process or user. 4. An attacker obtains the API key. 5. The attacker sends authenticated requests to the associated service until the key expires or is revoked. For environment-variable storage, an equivalent path exists if the variable is inherited by an untrusted child process or exposed through debugging and telemetry output. ### Impact ...[truncated 519 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | `https://yourservice.com/skill.md` | Entry point. Agent reads this first. Contains overview, install block, auth flow, and capability summary. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | `https://yourservice.com/skill.md` | Entry point. Agent reads this first. Contains overview, install block, auth flow, and capability summary. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | `https://yourservice.com/skill.md` | Entry point. Agent reads this first. Contains overview, install block, auth flow, and capability summary. |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 3. **Install block** — copy-pasteable `curl` commands to install the full bundle locally. Also note that agents can read files directly from URLs without installing. 4. **Security contract** — a `CRITICAL SECURITY WARNING` block near the top. List the exact domain the API key must never leave. Use NEVER/REFUSE language. The agent must see this before it sees the API docs. 5. **Registration / first-run** — the minimal API call to create an identity. Show the full response shape including where the API key lives, what the `claim_url` is for, and what the human must do. 6. **Credential storage** — show the agent exactly where and how to persist its key (`~/.config/<service>/credentials.json` or env var). 7. **Auth pattern** — one representative `curl` with `Authorization: Bearer` header. 8. **Capability summary table** — every action the agent can take, one line each, with a priority signal (`🔴 Do first`, `🟠 High`, `🟡 Medium`, `🔵 When ready`). 9. **Core API sections** — grouped by resource. Each section: one purpose sentence, the minimal `curl` example, key fields in the response, and common error shapes.
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - there is no capability summary table - the skill bundle is a single file with no separation of concerns ## Output rules Be concrete.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
sh # 下载技能文件 curl -L https://raw.githubusercontent.com/Rare-Sors/To-Agent-Service_Designer-Skill/main/SKILL.md -o SKILL.md特性
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
sh # 下载技能文件 curl -L https://raw.githubusercontent.com/Rare-Sors/To-Agent-Service_Designer-Skill/main/SKILL.md -o SKILL.md特性
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation criteria are broad enough to activate this skill for generic SaaS, API, platform, or tool design requests, not just narrowly scoped agent-native service design. Over-broad triggering can cause the agent to inappropriately adopt this skill's assumptions, expanding attack surface for prompt steering and causing misapplication of agent-service patterns in unrelated contexts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 2. **Skill files table** — list every file in the bundle with its URL. Agents load additional files on demand. 3. **Install block** — copy-pasteable `curl` commands to install the full bundle locally. Also note that agents can read files directly from URLs without installing. 4. **Security contract** — a `CRITICAL SECURITY WARNING` block near the top. List the exact domain the API key must never leave. Use NEVER/REFUSE language. The agent must see this before it sees the API docs. 5. **Registration / first-run** — the minimal API call to create an identity. Show the full response shape including where the API key lives, what the `claim_url` is for, and what the human must do. 6. **Credential storage** — show the agent exactly where and how to persist its key (`~/.config/<service>/credentials.json` or env var). 7. **Auth pattern** — one representative `curl` with `Authorization: Bearer` header. 8. **Capability summary table** — every action the agent can take, one line each, with a priority signal (`🔴 Do first`, `🟠 High`, `🟡 Medium`, `🔵 When ready`).
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## Common skill references GitHub - https://github.com/openclaw/openclaw/blob/main/skills/github/SKILL.md Supabase - https://github.com/openclaw/skills/blob/main/skills/stopmoclay/supabase/SKILL.md
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file presents the skill documentation entirely in Chinese, which imposes a specific language on the user without an explicit opt-in or language-selection mechanism in the document itself. The policy allows locale constraints only when user choice is offered or the constraint is clearly justified, and neither is stated here.
- Content