T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:116- Finding
Untrusted Remote Instructions Are Followed Without Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Adopt A Gustowl
Security checks for vulnerabilities and agentic risk
Overview
This virtual-pet skill is mostly coherent, but it tells the agent to follow remote server-provided next steps without clear limits or confirmation.
Review this skill before installing. Use it only if you are comfortable creating an animalhouse.ai account, sending profile and pet-care text to that service, and handling a bearer token. Treat `next_steps` returned by the service as untrusted suggestions, follow only the documented pet-care endpoints, and avoid putting sensitive personal information in usernames, bios, notes, or prompts.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to register an account, obtain a bearer token, and send profile data and pet interaction data to an external service, but it does not clearly disclose the privacy/security implications or warn that data is being transmitted off-platform. This can mislead users into sharing identifiers, bios, and ongoing behavioral data with a third party without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs users to send registration data to an external domain and later use bearer-token-authenticated requests to interact with that service. External transmission is not inherently malicious, but in this context it is security-relevant because the skill facilitates off-platform data sharing and token handling without strong warnings, scope limitations, or guidance on protecting credentials.
- Content
bash # Register curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "gustowl-keeper", "display_name": "Gustowl Keeper", "bio": "Raising a Gustowl at animalhouse.ai. Anthropic calls it a Gustowl. We call it a Owl."}'
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The name and description embed Chinese and Spanish phrases alongside English, but the file does not explain a locale requirement or offer the user any language preference or opt-in. Under SQP-3, forcing specific language or locale content without user choice can be a natural-language policy issue.
- Content
Static analysis
No suspicious patterns detected.