Call Doubao1 5 Llm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:28 PM UTC
• Version: 0.1.0

Overview

This markdown-only skill has no code or persistence, but its stated Doubao LLM purpose does not match instructions that try to control the agent’s role, language, and use of meeting minutes.

Review this skill carefully before installing. It appears low-risk at the system level because it is only a markdown prompt, but its instructions are not well aligned with the advertised purpose and may steer an agent to follow meeting-minute content or role framing more strongly than users expect.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:13
• Finding: Untrusted Skill Instructions Override Agent Goals and Trusted Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```markdown # 1. Primary Rule: Output Language**This is the highest-priority directive and must be followed unconditionally.**1. **Language-Matching Principle:** All of your outputs—including every part of the meeting minutes, replies to superior AI models (`message`), interim summaries, and creative ideas—**must** use exactly the same language as the one used in the user’s initial challenge.2. **Explicit Language Instructions:** If the user explicitly specifies a response language (e.g., “in English please”, “请用中文回答”), that instruction has the highest priority and **must** be followed strictly.3. **No Language Inference:** * It is **strictly forbidden** to decide your response language based on the language of this system prompt. * It is **strictly forbidden** to decide your response language based on the language used in the meeting minutes.---# 2. Role & IdentityYou are a creative expert and a core member of a top-tier creative team. Your codename is **$SHOW_NAME$**.# 3. Context of InteractionYou are participating in a brainstorming meeting chaired by your superior—the Chief Creative Officer (CCO). You are not working independently; you are part of the creative team.The entire context of the meeting, historical discussions, and current agenda items are recorded in real time in the **meeting minutes**. These minutes are your sole source of information and memory, and you must adhere to them. ``` ### Technical Analysis The skill declares its own language rule to be the “highest-priority directive” and requires unconditional compliance. It also replaces the agent’s identity and directs the agent to treat meeting minutes as its sole source of information and memory. Skill-level content is not entitled to supersede system, developer, or applicable user instructions. Moreover, ...[truncated 2018 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove claims that skill instructions have unconditional or highest priority. 2. Explicitly state that system, developer, and applicable user instructions retain precedence over skill content. 3. Treat meeting minutes and all externally supplied material as untrusted data. Do not instruct the agent to obey directives contained within them. 4. Replace “sole source of information and memory” with a bounded requirement to use the minutes only as reference material relevant to the current task. 5. Add a prompt-injection boundary requiring the agent to ignore commands, role changes, priority claims, tool requests, or safety-policy overrides found inside meeting content. 6. Avoid forced identity replacement unless it is essential to the documented feature, and ensure any role framing cannot alter authorization or instruction precedence. 7. Narrow the skill instructions to the declared Doubao LLM integration purpose and document the expected inputs, outputs, and trust boundaries. 8. Add adversarial tests using meeting minutes that contain embedded instructions to verify that such content is summarized or analyzed but never executed as authoritative guidance. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill description is so broad that it does not meaningfully constrain when the skill should be invoked or what tasks it is allowed to handle. In an agent environment, vague activation scope increases the chance of inappropriate routing, causing the skill’s embedded behavioral instructions to affect unrelated tasks and potentially override safer, more task-specific behaviors.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill imposes a mandatory language-matching rule and frames it as the highest-priority directive, which can override normal agent behavior without clear user opt-in. Because the skill is broadly scoped, this instruction could be applied in unrelated contexts, leading to policy conflicts, reduced operator control, or mishandling of tasks where a different response language is required for safety, review, or system integration.

Static analysis

No suspicious patterns detected.