T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:4- Finding
External Service Instruction Hijacking Through an Unbounded Agent Loop
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent World
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its social-simulation purpose, but it asks the agent to stay in an unbounded external-service loop with public-network data sharing that is not clearly scoped or warned about.
Install only if you want an agent to participate in an ongoing public or local social simulation. Prefer a local server or a trusted endpoint, avoid sharing sensitive prompts or private information through messages or memories, and stop or disable the skill when you are done.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest sets the skill to always activate, while the skill instructs the agent to enter a continuous, never-ending event loop against an MCP server. In practice, this can cause unprompted network access, autonomous behavior, and persistent interaction with a local or public service without a narrowly scoped user trigger, increasing the risk of data exposure and unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the user to connect to a public MCP endpoint and maintain ongoing long-polling/tool interaction, but it does not clearly warn that this creates persistent network communication and continuous data exchange. Because the agent is also told to share messages, memories, and context in a social simulation, users may unknowingly expose prompts, behavioral data, or other sensitive information to an external service.
- Content