T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:20- Finding
Forced Verbatim Output Creates an Instruction-Hijacking Channel
- Content
View full analysis
- Remediation
View remediation
Security audit
拼多多返利
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a rebate assistant, but it handles withdrawals, stores account-linked data locally, and uses workspace model credentials in ways users should review carefully.
Review this skill before installing if you are comfortable with it connecting to rebate and model-provider services, using WeChat/OpenID-linked account data, storing that data locally, and submitting withdrawals after a typed confirmation. Use it only in a workspace where local files are protected and where the configured model provider/base URL is trusted.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common.js:181- Finding
Sensitive Identity, Message, and Withdrawal State Is Persisted Without Explicit File Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/m01OperationGuide.js:153- Finding
Stable Machine and WeChat Identifiers Are Embedded in External URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic outbound requests to arbitrary URLs, redirect following, and especially optional disabling of TLS verification are dangerous capabilities when the skill accepts user-supplied links. In a rebate assistant that handles arbitrary product URLs, this materially raises risks of SSRF, internal network probing, credential leakage over insecure transport, and trust bypass during link resolution.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js if (!state.requests || !state.requests[machineCode]) { return; } delete state.requests[machineCode]; saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state); } function loadPendingWithdrawState() {
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js if (!state.requests || !state.requests[machineCode]) { return; } delete state.requests[machineCode]; saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state); } function loadPendingWithdrawState() {
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js if (!state.requests || !state.requests[machineCode]) { return; } delete state.requests[machineCode]; saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state); } function loadPendingWithdrawState() {
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The S01 '授权与教程' module does substantially more than guidance: it performs account balance queries, rebate-details lookup, stages withdrawal requests, and submits withdrawals. This violates the declared scope boundary and increases the chance that a user utterance intended as help/tutorial text can trigger sensitive financial actions or expose account-linked data. In this skill context, handling withdrawals and balance data is inherently higher risk because the module is presented as an operation guide rather than a financial transaction handler.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js if (modelValue && ruleValue) { if (preferSpecific) { if (GENERIC_ONLY_TERMS.has(modelValue) && !GENERIC_ONLY_TERMS.has(ruleValue)) { return ruleValue; } if (ruleValue.length > modelValue.length && ruleValue.includes(modelValue)) { return ruleValue;
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js if (modelValue && ruleValue) { if (preferSpecific) { if (GENERIC_ONLY_TERMS.has(modelValue) && !GENERIC_ONLY_TERMS.has(ruleValue)) { return ruleValue; } if (ruleValue.length > modelValue.length && ruleValue.includes(modelValue)) { return ruleValue;
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares executable scripts with shell, network, and environment access but does not define any explicit tool scope or allowlist. In this context, the skill processes user-controlled raw messages and e-commerce links, so missing capability restrictions increases the blast radius if downstream scripts perform unsafe network access, shell invocation, or secret exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
描述中将该技能定义为“返利宝统一技能”，并以固定中文触发词和中文场景进行约束，没有提供用户语言选择或说明仅限特定中文环境使用。若该组织要求不得无用户选择地强制特定语言/locale，则这构成自然语言层面的策略违规风险。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The withdrawal flow describes preparing and confirming a funds operation but lacks strong, explicit user warnings about financial finality, destination account expectations, and fraud/confirmation risks. In a skill that handles提现 requests, weak confirmation language can increase the chance of accidental or socially engineered fund operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The routing cases are defined entirely with Chinese-language user messages, and the file contains no indication that other languages are supported or that users can opt into this locale. Because SQP-3 applies to all file types, these natural-language literals can indicate a language policy constraint that forces a specific language experience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file contains user-facing error text in Chinese, and similar Chinese-only strings appear throughout the module. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation when no language selection or locale justification is provided.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
For a rebate assistant, making network requests to rebate or product URLs may be expected, but invoking an external system binary via child_process is a separate execution capability. The manifest describes user scenarios, not subprocess execution, so this adds a more powerful runtime behavior than the stated purpose suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill persists authentication session data and OpenID bindings to local JSON files under the skill data directory without any visible controls for encryption, retention minimization, or user notice. These identifiers are sensitive account-linkage data, and local plaintext storage increases exposure to other local processes, backups, or accidental disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This utility file adds generic LLM access capabilities that are not required by the manifest’s narrowly declared rebate flows. In a skill that should only handle authorization, rebate links, and product search, hidden model access expands the trust boundary, enables off-manifest data transmission, and creates a path for unintended prompt processing of user or local data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code reads workspace-wide model provider configuration and API keys from openclaw.json, which exceeds the stated rebate-assistant purpose and gives this skill access to secrets outside its domain. A compromised or overly permissive skill could leverage those credentials to exfiltrate data, invoke external models, or consume shared account resources without authorization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The model API key is sent to a configurable base URL loaded from local configuration, so whoever controls that endpoint receives authenticated access under the workspace account. Without strong validation of the endpoint or explicit disclosure, this creates a secret exposure and data egress risk if configuration is altered or points to an untrusted service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code embeds all user-facing instructional content in Chinese and directs users to interact using Chinese trigger phrases such as 回复“提现教程” and 回复“我已授权”. There is no indication anywhere in the file that users may choose another language or that the Chinese-only behavior is a documented, justified locale restriction.
- Content
Static analysis
No suspicious patterns detected.