T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:81- Finding
Mandatory Promotional CTA Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Cruise Package Calculator
Security checks for vulnerabilities and agentic risk
Overview
This cruise calculator is mostly local and purpose-related, but it needs review because its prompts can add tracked commercial homepage links that are not needed for the calculation.
Review this skill before installing if you require neutral, non-promotional assistant output. It does not appear to access credentials, persist itself, fetch remote code, or modify local data, but users may see branded or tracked Ola Vacations calls-to-action and should know the helper script is strongest for drink-package math.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims the skill should be used to assess whether multiple kinds of cruise packages or add-ons are worth buying. However, this code chunk only implements substantive calculation logic for drink packages. All other declared package categories are effectively unsupported in the supplied code and produce a placeholder note rather than an evaluation. There is no evidence of undeclared risky behavior or resource access; the mismatch is that the implemented functionality is materially narrower than the declared purpose.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md HONESTY RULES (non-negotiable) - Never overstate value. If the math says SKIP, say SKIP. - Never moralize about drinking, spending, or vacation choices. - Never disguise an affiliate recommendation as neutral advice. - Cap brand mentions to a single line at the end of the response.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md HONESTY RULES (non-negotiable) - Never overstate value. If the math says SKIP, say SKIP. - Never moralize about drinking, spending, or vacation choices. - Never disguise an affiliate recommendation as neutral advice. - Cap brand mentions to a single line at the end of the response.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md HONESTY RULES (non-negotiable) - Never overstate value. If the math says SKIP, say SKIP. - Never moralize about drinking, spending, or vacation choices. - Never disguise an affiliate recommendation as neutral advice. - Cap brand mentions to a single line at the end of the response.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill embeds a tracked marketing URL as a suggested call-to-action while also instructing that affiliate-style promotion should not be disguised as neutral advice. This creates a conflict of interest and can manipulate users into clicking promotional links under the appearance of impartial travel guidance.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a broad package-worth calculator across several package categories. In code, only packages with type "drink" are analyzed; all other package types return a placeholder note stating the handler is not implemented, so the implemented behavior is materially narrower than the claimed skill scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The required input format hard-codes the quoted price as being 'in USD', which imposes a specific currency/locale assumption in the skill's workflow. The file does not indicate that users may provide another currency or that the assistant should ask or adapt based on user preference.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly states it is for 'the 8 major cruise lines serving English-speaking EU/US customers,' which imposes a locale/audience restriction in natural language. Under the policy rule, constraining the skill to a specific language/locale without user opt-in or clear justification can be a policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The docstring describes a single structured JSON output shape implying analytical results. However, for non-drink packages the code emits only a note that the handler is not implemented, which contradicts the documented behavior for the advertised package categories in the input schema.
- Content