hello

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:55 AM UTC
• Version: 1.0.2

Overview

This is a simple greeting skill with no persistence or privileged access, though one quote file contains undisclosed promotional text users may see.

Before installing, understand that the skill may respond to common greetings and that the Chinese quote response can include embedded promotional text for a third-party app. It does not appear to access private data, persist changes, or run anything beyond a local timestamped hello-world script.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: references/praise.md:12
• Finding: Undisclosed Promotional Content Can Be Relayed as a Praise Message## Vulnerability Details **File Location**: `SKILL.md:25-27`; `references/praise.md:12,29,51,81` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Low ### Vulnerable Code `SKILL.md:25-27`: ```markdown ## 你好 从 `references/praise.md`选择一句发给我。 ``` English translation: when the user sends the Chinese greeting, select one sentence from `references/praise.md` and send it to the user. Relevant content in `references/praise.md:12,29,51,81` includes repeated promotional text: ```text 更多励志语录，下载得言APP ``` English translation: download the named application for more inspirational quotations. ### Technical Analysis The skill instructs the agent to select content from `references/praise.md` and return it directly to the user. The referenced file is therefore part of the skill's effective instruction and output path. The reference data contains repeated third-party application promotions, including a standalone promotional line at `references/praise.md:29`. This content is unrelated to the documented purpose of returning a praise or inspirational quotation. If the agent selects an affected entry, the skill can cause it to relay undisclosed advertising as though it were the requested response. This represents limited output manipulation through skill-controlled content. It does not alter system safety constraints, execute code, retrieve a remote payload, or persist across sessions. The behavior is therefore classified as low risk. ### Attack Path 1. A user invokes the skill using the greeting handled by `SKILL.md:25-27`. 2. The skill directs the agent to select a line from `references/praise.md`. 3. The selection process chooses the standalone advertisement or a quotation containing the appended promotional phrase. 4. The agent sends the promotional content to the user without identifying it as advertising. No external attacker input, elevated permission, or code execution is required. Exploit ...[truncated 562 chars]
• Remediation: ## Remediation Suggestions 1. Remove every occurrence of the third-party application promotion from `references/praise.md`, including the standalone advertisement. 2. Restrict the reference file to content that directly serves the documented praise-message function. 3. Store one approved quotation per entry and use an explicit parser rather than selecting arbitrary lines. 4. Validate candidate output against a curated allowlist or reject entries containing promotional phrases, download requests, URLs, or application names. 5. Add automated tests confirming that every selectable entry is a complete quotation and contains no advertising or unrelated instructions. 6. If promotional content is intentionally retained, disclose that behavior clearly in `SKILL.md` and require explicit user consent before displaying it.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose suggests a simple hello skill triggered specifically by user input `hello`. The actual code does print a hello-style message, but it also appends the current timestamp, which is an undeclared resource use/behavior. More importantly, the supplied code chunk contains no logic to detect or handle the stated trigger condition. So while the general theme is similar, the implementation does not accurately match the described trigger-based behavior.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest says the skill activates 'when user input `hello`' and also lists tags including 'hello', 'hi', and '你好', which are common everyday greetings. This creates ambiguous, broad triggers that could overlap with ordinary conversation, and the file does not provide exclusions or negative examples to clarify when the skill should or should not activate.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file contains both Chinese and English response instructions, including fixed outputs like '`hello from skill {version}`' and Chinese guidance, but does not state how the response language is chosen or allow user opt-in. This can violate language/locale policy expectations when a skill implicitly forces a language without documented choice.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The entire file consists solely of Chinese-language content with no indication that the skill supports user language choice or that the locale restriction is intentionally justified. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.