T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:7- Finding
Global Agent Workflow and Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Using Superpowers Tianjin
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparent about its goal, but it tries to take broad control of the agent's workflow for every conversation and should be reviewed carefully before installation.
Install only if you intentionally want a global skill-routing discipline that runs at the start of conversations. Review the broad mandatory wording first, because it may cause unnecessary skill invocations and can give later-loaded skills more influence over the session than users expect.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to activate at the start of essentially any conversation, which creates an overbroad control layer that can intercept unrelated tasks and force unnecessary tool use. In agent systems, this kind of universal gating can be abused to override safer routing, increase prompt-surface exposure, and cause denial-of-service style behavior where the agent is compelled into recursive or irrelevant skill invocation.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The 'even a 1% chance' rule is an intentionally vague threshold with no operational boundary, causing the agent to treat nearly all inputs as requiring skill invocation. This ambiguity is dangerous because it enables prompt-level capture of the workflow, encourages excessive tool calls before normal reasoning or clarification, and can be chained with other skills to create self-reinforcing behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction 'Announce: 'Using [skill] to [purpose]'' hard-codes an English user-facing phrase in the workflow and does not offer localization or user language choice. This can violate language or locale policy where user-facing output should respect user preference or environment.
- Content