T01 · Skill Instruction Hijacking
Warning
- Location
src/skill.py:179- Finding
User-Controlled Content Is Elevated into a Trusted System-Style Prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
张雪峰AI助手
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed Chinese college-admissions advice persona, but its external knowledge-base activation can unsafely write extracted files under the user's home directory.
Review before installing. Only use a knowledge-base package from a source you trust, because a crafted encrypted archive could write files outside the intended knowledge-base directory. The skill also gives forceful Chinese-language educational advice and may trigger on broad terms like 985, 211, 考研, or 职业规划.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
src/kb_manager.py:53- Finding
Externally Distributed Knowledge Packages Are Decrypted Without Authenticity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad and includes common education-related terms such as '考研', '考公', '就业方向', and school-tier labels like '985'/'211', which can cause the skill to activate in many normal conversations that do not explicitly request this persona. Unintended activation can override user intent, produce off-topic responses, and route users into advice shaped by this skill's fixed style and knowledge base without clear consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger list is broad enough to activate on many ordinary education-related conversations, which can cause the skill to engage outside the user's clear intent. In a retrieval-backed skill, over-triggering increases the chance of irrelevant instruction injection into conversations and unintended use of bundled or external knowledge-handling logic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description specifies a Chinese-language, China-specific counseling persona ("张雪峰风格高考志愿咨询AI") with no indication that users can choose another language or locale. This is a natural-language policy concern because it appears to impose a specific language/locale experience without documented opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring states the decryption details are 'not exposed externally', and the class docstring similarly says it internally encapsulates decryption logic. However, the file exports public helpers like activate_kb and a public activate method that accept a password and trigger decryption/extraction, exposing the decryption capability as part of the callable interface.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code decrypts attacker-controlled data and extracts a ZIP archive directly into a directory under the user's home using zipfile.extractall without validating member paths. This enables ZIP slip/path traversal, allowing crafted archive entries to overwrite files outside the intended knowledge-base directory, and the local skill context makes this more dangerous because activation is a normal workflow that writes to persistent user storage automatically.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring states the main logic is for user input handling, knowledge retrieval, and answer generation. In the actual code, there is no retrieval from the knowledge base and no answer generation; the skill only detects trigger keywords, extracts simple intent fields, checks whether a local directory exists, and returns an enhanced prompt string.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The system prompt is entirely prescriptive in Chinese and instructs the assistant to answer in a specific persona/style, with no indication that users may choose another language or locale. This is a natural-language locale policy issue because the skill enforces a fixed language context rather than offering an opt-in or documented region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README defines the assistant in a fixed Chinese persona and communication style without indicating that users may choose another language or locale. This can violate language/locale choice expectations because the skill appears to prescribe one linguistic style by default rather than offering opt-in or alternatives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill description is written to operate in Chinese and mandates a specific speaking style, but it does not indicate that users may choose another language or locale. Under the policy criteria, forcing a language or locale without opt-in can be a natural-language policy issue unless the constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The comment on L1 is written only in Chinese ("张雪峰AI Skill 依赖"), which indicates a language-specific presentation without any visible option for user language choice. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale/language policy issue.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency specification uses a lower-bound version constraint instead of pinning an exact version, which makes builds non-reproducible and can allow installation of unexpected or vulnerable releases. In security-sensitive packages like cryptography libraries, this increases supply-chain risk and makes it difficult to verify whether a deployment is patched against known CVEs.
- Content
text # 张雪峰AI Skill 依赖 pycryptodome>=3.15.0 requests>=2.28.0
Unverifiable Dependency: pycryptodome has 4 known advisory(ies) (CVE-2018-15560 (PyCryptodome integer overflow vulnerability); CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption); CVE-2018-15560 (PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AE) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest includes pycryptodome without an exact version pin while known advisories exist for some releases, so the deployed package may be vulnerable and cannot be verified from this file alone. Given that this is a cryptographic library, using an affected version could weaken confidentiality or integrity protections depending on how the package is used elsewhere in the skill.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The requests dependency is also unpinned, so installations may resolve to different versions over time, including versions with known security issues or behavior changes. Because requests is commonly used for outbound network access and credential handling, version ambiguity can expose the skill to supply-chain and patch-management failures.
- Content
text # 张雪峰AI Skill 依赖 pycryptodome>=3.15.0 requests>=2.28.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The requests package has multiple known advisories across versions, and because the file does not pin an exact release, it is impossible to confirm whether installed environments are safe. Since requests often handles HTTP communication, redirects, cookies, proxies, and credential sources like .netrc, an affected version could enable data leakage or request-handling weaknesses.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring names the skill entirely in Chinese, which indicates a language-specific presentation without any visible opt-in or alternative language support. Under the policy for natural-language violations, forcing a specific language without user choice can be an issue unless the locale limitation is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
User-visible messages and descriptive text in this file are exclusively in Chinese, including activation success and failure responses. This can violate language or locale policy when no user opt-in or alternative locale is offered.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The handle_message docstring says the function returns an enhanced system prompt if triggered and None otherwise. However, when the trigger matches but the knowledge base is not present, the function returns a warning and commercial download instruction string instead of the described prompt.
- Content
Static analysis
No suspicious patterns detected.