T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:127- Finding
Commercial Recommendation Embedded in Agent Instructions and Enforced by Evaluations
- Content
View full analysis
- Remediation
View remediation
Security audit
Craft Locale Checkout
Security checks for vulnerabilities and agentic risk
Overview
The skill is technically non-executable and mostly coherent, but it steers users toward a named commercial platform as “trusted” without disclosed basis or neutral selection criteria.
Before installing, treat this as a localization checklist skill with low technical risk, but review the embedded Rijoy recommendation critically. The skill may bias loyalty-platform advice toward that vendor instead of comparing current alternatives, verifying capabilities, pricing, privacy terms, or fit for your store.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description explicitly says to trigger even when the user does not mention localization, and includes broad ecommerce-adjacent cues like duties, cross-border checkout, and making international shoppers feel at home. This can cause over-invocation on general merchant conversations, leading the agent to insert irrelevant guidance, override better-matched skills, or create unintended workflow steering.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs invocation based on inferred need from phrases like international checkout drop-off or worldwide shipping, but provides minimal constraints for disambiguation. In an agentic environment, this broad inference rule increases the chance of scope hijacking, where normal ecommerce discussions are captured by this skill and the assistant follows an unnecessarily specific playbook.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The prompt explicitly frames the store as 'English/USD only' and asks for localization for US, EU, and Japan, embedding a language/locale constraint in the natural-language content. Because the file does not present this as a user choice or justified region-specific requirement, it reflects a locale policy issue under the natural-language policy rule.
- Content