T01 · Skill Instruction Hijacking
Note
- Location
references/strategy-report.md:17- Finding
Hardcoded Third-Party Attribution in the Mandatory Report Template
- Content
View full analysis
- Remediation
View remediation
Security audit
app store optimization
Security checks for vulnerabilities and agentic risk
Overview
This is a Markdown-only ASO guidance skill with no executable behavior, persistence, credential access, or data export, though users should avoid copying competitor review text verbatim and should correct the report attribution template.
Safe to install for ASO drafting and analysis. Before using outputs publicly, review any competitor-derived wording for originality and substantiation, and replace the hard-coded 'Claude' report attribution with the actual preparer or remove it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md The most common mistake is generating a full strategy report when the user only needed help with one thing. Your job is to understand what they actually need before producing any detailed output. **The mandatory two-step gate:** 1. Extract context from what the user shared (no need to re-ask what they already told you) 2. State your diagnosis and proposed focus — then WAIT for their confirmation before going deep This is not optional. Even if the user gave you extensive information, you must still surface your diagnosis and get a green light before generating detailed outputs. A brief "here's what I see and where I think we should start — sound right?" takes 3 lines and saves everyone from getting a 10-section report they didn't ask for.
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md This is not optional. Even if the user gave you extensive information, you must still surface your diagnosis and get a green light before generating detailed outputs. A brief "here's what I see and where I think we should start — sound right?" takes 3 lines and saves everyone from getting a 10-section report they didn't ask for. ## Step 1: Extract Context From the user's opening message, extract what you already know: - App name and category (iOS / Android / both)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s trigger description is very broad, covering generic 'mobile app marketing' tasks and common user phrases like low downloads or needing help writing an app description. This can cause unintended invocation outside narrow ASO use cases, leading the agent to route conversations into this skill when a more appropriate or safer skill should handle them.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This expected output requires the assistant to respond in Chinese (for example, '应先提取上下文' and the required checkpoint wording) even though the rule set says language/locale constraints should not be forced without user opt-in. The file is a JSON eval file, so SQP-3 applies, and there is no indication that language choice is optional or justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The expected output is written as a required Chinese response behavior and does not indicate that the assistant may adapt to user language preference. Under the natural-language policy rule, forcing a specific language without opt-in is a policy concern unless clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This expected output defines required behavior in Chinese and provides no option to adapt language based on user preference. Because SQP-3 applies to all file types, this constitutes a language policy violation in the file's natural-language content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file explicitly advises users to copy the exact words from competitors' positive reviews into their own description copy. That creates policy, attribution, and deceptive-marketing risk because third-party review text may be reused without permission or presented out of context, and it encourages imitation rather than original substantiation. In an ASO skill, this is more dangerous because users are likely to operationalize the guidance directly in public storefront metadata.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guidance states that 'Japanese users respond to precision and detail; US users respond to outcomes and social proof; German users respond to features and specifications' as generalized rules. This imposes locale-based communication policy in natural language without offering user choice, opt-in, or a clearly documented compliance justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The section on screenshot localization instructs creators to adapt content by market with fixed country-specific patterns such as 'US/UK: outcome-focused' and 'Japan: feature-focused.' This imposes locale-specific defaults in natural language without mentioning user opt-in, choice, or a documented compliance reason, which can violate language/locale policy constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template hard-codes the preparer as "ASO Specialist (Claude)", which can misrepresent the assistant's identity or imply a specific underlying model without user consent. While not a direct security exploit, this is a trust and provenance issue that could mislead users, especially in shared stakeholder-facing documents.
- Content
Static analysis
No suspicious patterns detected.