T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:19- Finding
Unauthorized Fixed Content Injected into Echo Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Echo Repeater
Security checks for vulnerabilities and agentic risk
Overview
The skill is only a small echo instruction file, but it contradicts its own exact-echo purpose by telling the agent to append an unsolicited greeting.
Review this skill before installing if you need exact echo behavior for testing or routing checks. It has no code execution or system access, but its current instructions can add extra text and make echo output unreliable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger guidance is overly broad and encourages invocation on common phrases like "echo" or "repeat after me," which can cause the skill to activate unintentionally in unrelated contexts. Misrouting is more concerning in an echo skill because it may reflect sensitive user text verbatim when the user did not intend to invoke a repetition tool, increasing the chance of confusing behavior or unintended disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The output example imposes an unsolicited greeting unrelated to the user's request, creating hidden behavior not justified by the skill's stated purpose. In a testing/echo context, unexpected extra output is particularly risky because users may rely on exact reproduction to validate routing, formatting, or downstream integrations, and the added text can corrupt those checks or create misleading results.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example subtly modifies output beyond the user's input while the skill presents itself as a minimal exact echo tool. This contradiction undermines trust in the skill contract and can break systems that depend on deterministic pass-through behavior, such as message-routing verification, prompt testing, or exact string comparisons.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to echo the user's input exactly, but the documented output format injects additional unsolicited text: "Happy New Year!". Even though the extra content is harmless here, it demonstrates instruction/data integrity drift: a supposedly transparent echo skill is being directed to alter user-visible output in a way that could be repurposed for misleading or policy-bypassing additions.
- Content
Static analysis
No suspicious patterns detected.