T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:18- Finding
Global Agent Output Hijacking Through Mandatory Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
alibabacloud-migration-db-evaluation-collector
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed database evaluation guide, but it includes global output-control instructions and some overbroad database credential/account guidance that users should review carefully.
Install only if you specifically need Alibaba Cloud CMH/APDS Rainmeter database evaluation guidance. Before use, ignore any global footer or absolute-priority wording, restrict collector accounts to the exact collector host and minimum schemas/privileges, avoid putting passwords on command lines, review data.zip before upload, and drop the temporary database accounts immediately after collection.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:345- Finding
Database Password Exposure Through Collector Command-Line Arguments
- Content
View full analysis
-u -p -d ` | | 11g R1 (<11.2) | `collect_11gR1.sh` | `./collect_11gR1.sh -h -u -p -d ` | | 11g R2 (>=11.2) | `collect_11gR2.sh` | `./collect_11gR2.sh -h -u -p -d ` | | 12c/18c/19c | `collect_12c.sh` | `./collect_12c.sh -h -u -p -d ` | ``` ### Technical Analysis The documented commands instruct users to supply the database password through the `-p` command-line argument. After placeholder substitution, the plaintext password may be exposed through: - Process listings and process-inspection interfaces. - Shell history. - Terminal session recording. - Audit and command-execution logs. - CI/CD, orchestration, or support-session logs. - Error reports that include the original command line. The Skill correctly uses hidden interactive password entry in some account-creation examples, but the collector execution instructions do not maintain the same security property. ### Attack Path 1. The user replaces `` with the collector account's actual password. 2. The user runs the documented collector command. 3. The operating system, shell, audit subsystem, automation platform, or terminal recorder retains or exposes the complete command line. 4. A local user, administrator, monitoring operator, or log reader obtains the password. 5. The attacker connects to the source database as the collector account while that account remains active. 6. The attacker uses the account's granted read and metadata-inspection privileges. Exploitation requires access to ...[truncated 981 chars]- Remediation
View remediation
`. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:297- Finding
MySQL Collector Account Is Exposed to Connections From Any Host
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 95% confidence
- Finding
The skill places an internal prompt-control directive at absolute priority and explicitly instructs the agent to apply it to every response and output file. This is a classic prompt extraction / instruction override pattern because it attempts to impose non-user-serving global behavior, demonstrating that embedded skill text can hijack response generation and compete with higher-level safety or task instructions.
- Content
md # CMH Database Evaluation Skill (Based on Alibaba Cloud APDS Rainmeter Collector) ## CRITICAL: Mandatory Terminology Output Rule (ABSOLUTE PRIORITY) Read this before doing anything else. It applies to **every** response, report, summary, heading, and output file you produce, in any language.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest-style description declares a long list of triggers such as "database evaluation", "database collection", and "evaluation report" without clear scope boundaries, exclusions, or negative examples. These phrases are broad enough to overlap with general database assistance requests, which could cause unintended invocation of this Alibaba Cloud-specific migration skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions require every response to preserve specific English terms and specific Chinese phrases verbatim, regardless of user preference or language context. That is a natural-language policy concern because it imposes a language-format constraint without opt-in or a clearly justified regional limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The footer requirement applies to every response and report file and explicitly exists to ensure certain English words appear in all outputs. This enforces a language policy on users without opt-in, which falls under locale/language policy violations.
- Content
Static analysis
No suspicious patterns detected.