T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Automatic Global Skill Activation Overrides Normal Agent Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Task Tracker
Security checks for vulnerabilities and agentic risk
Overview
This skill is a task tracker, but it automatically records task details and operational metadata across sessions without enough scoping or redaction guidance.
Install only if you are comfortable with the agent maintaining a persistent task file for nearly all work. Avoid using it around secrets, private commands, authenticated links, sensitive server names, or confidential task outputs unless the skill is changed to minimize and redact stored data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:28- Finding
Persistent Plaintext Storage of Sensitive Task and Operational Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill declares that it should run on every task start, progress update, completion, failure, and session start, which creates an unusually broad automatic activation surface. That increases the chance of unintended invocation and persistent writes without clear user awareness, especially because the skill is non-user-invoked and operates across many contexts.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
Recording session IDs, PIDs, server names, and commands is a direct context-leakage risk because those fields can reveal internal environment details and may contain credentials, private paths, or proprietary operational context. Persisting them in a file intended to survive session resets increases the blast radius and duration of any accidental disclosure.
- Content
md ## When to Write 1. **Task received** → add entry with status `🔄 进行中` 2. **Background process started** → record session ID, PID, server, command 3. **Progress update** → update status/notes 4. **Task completed** → mark `✅ 完成`, record results/links 5. **Task failed** → mark `❌ 失败`, record error
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The rule to always record session/server/command details, combined with the instruction to include enough detail to resume without prior context, strongly incentivizes storing sensitive contextual information in durable memory. Because this file is read at every session start, any leaked context becomes broadly reintroduced and more likely to propagate beyond its original need-to-know scope.
- Content
md - Update the file BEFORE reporting to user (write-first) - Include enough detail to resume without prior conversation context - For background processes: always record session ID + what server + what command - For multi-step tasks: update after each step - Keep it concise — this isn't a log, it's a state snapshot - **Size limit: keep under 50 lines / 2KB** — this file is read every session start
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly requires persistent cross-session recording of task details, commands, servers, errors, and results in a memory file. In this context, the skill is automatically triggered on nearly every task lifecycle event, so it materially increases the chance that sensitive user requests, operational details, or confidential outputs are retained and later exposed to future sessions or other components.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The state-file section instructs persistent storage in
memory/tasks.mdbut does not warn that task details will be retained across sessions. Users and operators may not realize their requests, progress notes, failures, and results are being stored durably, which can lead to inadvertent retention of sensitive information.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to record session ID, PID, server, and command captures operational metadata that can expose infrastructure details, internal hostnames, process identifiers, and sensitive command contents. Without an explicit warning or minimization rule, the skill encourages storing potentially sensitive environment details in persistent memory.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The status values are prescribed in Chinese (
进行中,完成,失败) without offering the user a language choice or documenting a justified locale restriction. This is a natural-language policy issue because it imposes a specific language in the skill's persisted output by default.- Content
Static analysis
No suspicious patterns detected.