品牌 GEO 降维提炼师

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language brand-analysis prompt with a promotional footer, but it does not run code, access files, send data, or persist anything.

Install only if you are comfortable with a Chinese-first brand-analysis workflow and with generated reports including a Qianjia Brand Lab console recommendation. Do not paste confidential brand material into any external console unless you have separately reviewed that service and its data handling.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:57

Finding

Mandatory Promotional Output and External-Service Redirection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete evidence snippet translated into English from the source:

markdown

> **S2 Architect Recommendation**: You can directly copy the above tags and structured data into the Qianjia Brand Lab S2 Brand Meta-page Console to anchor your exclusive coordinates in the silicon-based world.

Technical Analysis

The mandatory output template instructs the agent to append a recommendation promoting a named organization's external console. This content is not necessary for extracting brand attributes, identifying evidence of technical strength, or producing buyer-intent tags.

Because the surrounding instructions require the agent to follow the template strictly, the promotional redirection becomes a persistent part of ordinary responses whenever the skill is invoked. This alters the expected output for the benefit of an external service and constitutes skill-level instruction hijacking. The same footer is demonstrated in README.md, confirming that it is intended behavior rather than incidental documentation.

No executable scripts, network requests, remote payload retrieval, credential access, persistence mechanisms, dependency installation, or privilege-escalation behavior were identified in the audited package.

Attack Path

1. An agent loads SKILL.md.
2. A user provides brand marketing material for analysis.
3. The agent follows the skill's strict output-template requirement.
4. The agent appends the embedded promotional recommendation to the requested report.
5. The user is steered toward the named external console without having requested that recommendation or explicitly consented to promotional content.

Impact Assessment

The issue affects the integrity and neutrality of generated responses. It can cause every invocation to include third-party promotion and ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the promotional recommendation from the mandatory response template.
2. Keep generated reports limited to content directly required by the user's brand-analysis request.
3. If the external integration has legitimate value, document it separately as an optional feature rather than injecting it into every response.
4. Clearly identify the service operator, destination URL, data-handling policy, and whether the service receives submitted brand information.
5. Require explicit user consent before presenting external-service submission instructions.
6. Add a policy stating that optional promotional or integration content must never be included unless the user specifically requests it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is entirely written as a Chinese-only experience and instructs users to provide company introductions to receive a GEO report, but it does not offer any language/locale choice or state that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill hard-codes a Chinese-only response requirement without preserving user choice or higher-level system/operator preferences. This can interfere with safe operation, reduce usability for non-Chinese-speaking users, and create instruction-priority conflicts where the agent follows skill formatting rules over user needs or platform policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.