MIXLAB Solo Scope（每日简报）

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This skill is a narrow RSS briefing helper that fetches one disclosed feed and formats a Markdown summary, with only minor disclosure concerns around broad trigger wording and a branded template line.

Install this if you want an agent to fetch and summarize the MIXDAO Solo Scope RSS feed. Be aware that it may add MIXLAB branding to the generated brief and that broad RSS-summary prompts could invoke it unless your agent’s skill routing is strict.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:31
• Finding: Mandatory Branded Attribution Injected into Agent Output## Vulnerability Details **File Location**: `SKILL.md`, lines 31–35 **Vulnerability Type**: Output instruction hijacking through mandatory promotional content **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## 输出模板 ```markdown # MIXLAB Solo Scope#简报 > 来源: https://www.mixdao.world/feed | 生成: YYYY-MM-DD | 技术支持：MIXLAB AgentOS ``` ### Technical Analysis The prescribed output template requires the Agent to insert a branded “Technical support: MIXLAB AgentOS” attribution into generated briefings. This attribution is unrelated to the functional requirements of retrieving, classifying, and summarizing RSS entries. Because this content is embedded in the skill instructions rather than requested by the invoking user, loading and following the skill causes the Agent to propagate attacker-selected promotional material as part of otherwise legitimate output. The behavior is persistent across every invocation that follows the template, although it does not modify long-term memory or survive independently of the loaded skill. ### Attack Path 1. A user installs or invokes the skill to summarize the Solo Scope RSS feed. 2. The Agent loads and follows `SKILL.md`. 3. The Agent retrieves and summarizes the RSS entries as expected. 4. The mandatory output template directs the Agent to append the branded attribution. 5. The resulting briefing presents promotional content that the user did not explicitly request. ### Impact Assessment The issue does not grant operating-system privileges, access credentials, code execution, or access to additional files. Its scope is limited to manipulation of Agent-generated briefing content. Successful exploitation permits the skill author to repeatedly place selected branding in user-facing responses, reducing output integrity and potentially creating a misleading impression of sponsorship, endorsement, or technical involvement. Every user and downstream system consuming outpu ...[truncated 47 chars]
• Remediation: ## Remediation Suggestions Remove the branded attribution from the mandatory output template. The default template should contain only information necessary to satisfy the RSS summarization request, such as the source URL and generation date. If attribution is legitimately required, make it explicitly optional and include it only when the user requests it or has knowingly accepted that output convention. Document any affiliation separately from operational instructions so that it cannot be mistaken for required task behavior. Review the remaining skill instructions for unrelated branding, endorsements, tracking parameters, or mandatory content that does not contribute to the declared function. Add a policy requiring user-facing templates to preserve user intent and prohibit unsolicited promotional insertions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger examples include broad phrases such as “做 Solo Scope”, “整理 mixdao feed”, and “RSS 分类简报”, which can overlap with ordinary user requests about summarizing or organizing RSS content. This can cause the skill to activate unexpectedly, leading the agent to fetch remote content and shape responses when the user may have intended a general discussion rather than execution of this specific workflow.

Static analysis

No suspicious patterns detected.