T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Agent identity, workflow, and tool-use instruction hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Rob Pike Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese-language Rob Pike style/advice skill made of Markdown, with some install and activation cautions but no hidden code, persistence, credential handling, or destructive behavior.
Install this if you want a Chinese-language Pike-style advisory persona for Go and software-design questions. Review the broad triggers and mandatory web-research behavior, and prefer a pinned or otherwise verified installer command before running npx.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:80- Finding
Unpinned third-party package execution through npx installation commands
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire README presents the skill in Chinese and all example invocations are Chinese, without offering a user language choice or documenting that the skill is intentionally Chinese-only. This may violate language/locale policy when users are not given an explicit opt-in or alternative locale.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README says users can trigger the generator by saying “蒸馏一个 XXX”, which is a very generic natural-language pattern rather than a narrowly scoped command. Without explicit constraints or negative examples, this could overlap with normal discussion and cause unintended activation in chat contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list contains broad technical phrases such as Go language, error handling, interface design, and debugging methods that commonly appear in ordinary engineering discussions. This can cause the skill to activate outside the author's intended scope, unexpectedly steering responses into a persona-driven workflow and mandatory tool-usage pattern, which increases the chance of inappropriate behavior or policy bypass in unrelated contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The instructions require the agent to maintain Pike's style and supporting logic, while the overall skill description and examples are written to steer responses in a fixed Chinese-oriented presentation without any user opt-in for language or locale preference. Under the policy, forcing a language or locale without offering choice is a natural-language policy concern unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file presents all instructional and descriptive content in a single language, Chinese, with no indication that the user can choose another language or that the skill is intentionally region-specific. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all instructional and descriptive content in Chinese with no indication that the language is optional or that the document is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The title and the document body present the material in Chinese, while the file does not state that it is intended only for Chinese-speaking users or provide an opt-in language choice. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all guidance in Chinese, including the title and explanatory content, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. The stated policy requires flagging language or locale constraints when they are forced without user opt-in or clear justification.
- Content
Static analysis
No suspicious patterns detected.