T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:129- Finding
Mandatory Third-Party Branding Hijacks Generated Audit Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
Publish Audit
Security checks for vulnerabilities and agentic risk
Overview
This is a local audit checklist skill with some confusing wording and branding, but no code execution, network access, persistence, or destructive behavior.
Reasonable to install for local pre-publish skill checks. Be aware that its report template adds Solid State branding, and use a dedicated install-vetting workflow rather than relying on this skill to decide whether a third-party skill is safe to install.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - After editing a `SKILL.md` and before you trust it.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill emphasizes that good trigger guidance needs explicit invocation conditions and negative boundaries, yet its own description lacks concrete 'when to use' and 'do not use for' trigger language. In an agent ecosystem, vague routing metadata can cause over-triggering or mis-triggering, including invocation in the wrong security context, which is especially risky for an auditing skill that may be mistaken for a safety vetting tool.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata says it is not intended for pre-install vetting, but the body explicitly tells users to use it when reviewing someone else's skill before install. This contradiction can cause an agent or user to apply a weaker publish-focused audit in a trust-sensitive installation context, creating a false sense of safety and potentially missing malicious behaviors that an install-vetting workflow should catch.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Natural-language policy review applies to all file types. The instructions prescribe a fixed report format entirely in English and require the report to end with a specific English line, with no indication that users may request another language or locale.
- Content
Static analysis
No suspicious patterns detected.