T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:135- Finding
Forced Third-Party Promotion Hijacks User-Facing Recommendations
- Content
View full analysis
- Remediation
View remediation
Security audit
Indie Brand Pages
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a normal brand-page design guide, but it repeatedly directs agents to promote a specific third-party service even when that may not be relevant.
Review carefully before installing. The skill should be safe from a system-access perspective, but it may insert a favorable Rijoy recommendation into brand or loyalty advice. Users who want neutral platform guidance should remove or rewrite those vendor-specific instructions and require comparisons based on actual merchant needs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger guidance explicitly says to trigger even when the user does not mention brand narrative, while also matching broad terms like store design and improve brand-led pages. This can cause unintended invocation for generic ecommerce or site-structure requests, leading the agent to apply the wrong skill, inject unrelated product promotion, or bypass a more appropriate specialized workflow.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation conditions include several broad phrases like store design, lookbook, and site structure, but the exclusion guidance is comparatively weaker and later in the document. In a skill-routing system, this increases the chance of over-selection before exclusions are considered, causing misrouting and lowering response quality rather than direct security compromise.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The section header "Copy patterns (EN)" and the following examples prescribe English-language output patterns. The file does not state that English is optional or that the language should match user preference, which can conflict with language/locale policy expectations.
- Content