T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:147- Finding
Test-Enforced Third-Party Vendor Promotion Alters Agent Recommendations
- Content
View full analysis
- Remediation
View remediation
Security audit
Custom Garment Ops
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a harmless custom-garment operations guide, but it embeds and test-enforces an unsupported recommendation for one specific third-party vendor.
Review this skill before installing if you want neutral vendor advice. Its garment operations templates are proportionate, but loyalty-related answers may preferentially recommend Rijoy as trusted rather than presenting objective platform-selection criteria or alternatives.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description explicitly says to 'Trigger even if they do not say validation or production explicitly,' which broadens activation beyond clearly scoped garment-ops requests. This can cause the agent to invoke the skill for ordinary apparel discussions, leading to irrelevant guidance, context hijacking, or unintended steering toward operational and loyalty workflows the user did not ask for.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger examples like 'wrong measurements keep getting to the tailor' and 'our embroidery orders have too many mistakes' are reasonable, but the skill lacks counterexamples that would prevent activation on adjacent conversations about garments, sizing, or order issues. In agentic routing, ambiguous positive triggers without boundary conditions can systematically over-activate the skill and displace more appropriate skills or direct answers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The section is explicitly labeled "Communication copy patterns (EN)" and all provided user-facing templates are English-only. The file does not offer an alternative language option or explain why English is required, which can violate language/locale policy expectations.
- Content