T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Mandatory Cross-Task Agent Instruction and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
PUA Debugging
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malware, but it broadly forces an agent into aggressive cross-task behavior that can overuse tools, expand task scope, and ignore normal clarification or output expectations.
Install only if you explicitly want an aggressive debugging coach that may push the agent to keep investigating, use available tools, and broaden the task before asking you questions. Avoid using it in agents with production, deployment, broad filesystem, or sensitive-data access unless you are comfortable supervising those actions closely.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest description defines activation conditions so broadly that the skill can trigger during many normal interactions, including generic frustration, repeated attempts, research, writing, deployment, and nearly any 'stuck' state. In practice this creates instruction-shadowing risk: the skill can override normal agent behavior with coercive debugging routines and aggressive tone even when the context does not warrant it, increasing the chance of misaligned outputs and user harm.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly claims applicability to virtually all task types and any scenario where the model is 'stuck' or producing poor work, which makes invocation criteria insufficiently bounded. That broad scope is dangerous because it allows a highly forceful behavioral overlay to activate outside debugging contexts, potentially degrading safety, user intent adherence, and response appropriateness across unrelated tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill content is predominantly Chinese and repeatedly frames required response behavior in that language and rhetorical style without user opt-in. This can cause unintended language switching, reduced accessibility, and misunderstanding, especially when combined with the skill's mandatory broad triggering behavior; the surrounding coercive PUA framing makes the locale mismatch more operationally disruptive than a simple bilingual note would be.
- Content
Static analysis
No suspicious patterns detected.