T01 · Skill Instruction Hijacking
Warning
- Location
references/event-analysis-template.md:161- Finding
Hard-Coded Third-Party Identity Causes Misleading Report Attribution
- Content
View full analysis
- Remediation
View remediation
Security audit
News Event Driven Analysis
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only stock event analysis skill with no code or persistence, but it can produce high-stakes trading-style guidance that users should not treat as personalized financial advice.
Before installing, understand that this skill is for Chinese stock-event analysis and may generate buy/sell, timing, position, and stop-loss suggestions. Treat those outputs as educational market commentary, verify current data independently, and avoid publishing reports with the bundled hard-coded analyst attribution unless it is removed or replaced with a verified source.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown content, including the manifest description and all usage instructions, is exclusively in Chinese. Under the policy rule, forcing a specific language without offering a user choice or documenting a justified region-specific constraint is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document gives concrete investment guidance, including timing, stock-selection principles, position sizing, and stop-loss advice, but does not include a clear disclaimer that the material is educational rather than financial advice and may cause losses. In a skill context, users may reasonably treat this as actionable investment instruction, increasing the risk of financial harm or misplaced reliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the model to provide operational trading advice such as whether to buy, how much to buy, and when to buy, but it does not present a clear upfront warning that this is not financial advice and may be inaccurate or unsuitable. In practice, users could rely on high-risk, time-sensitive recommendations without understanding limitations, suitability, or regulatory concerns.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill uses very broad invitation text like asking users to paste any news or announcement for analysis, which can cause the skill to trigger on generic requests outside a narrowly scoped context. That increases the chance of over-activation and unsolicited financial-analysis behavior, especially in systems that route based on natural-language matching.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template content, section headings, and analyst label are entirely written in Chinese, which implies the skill expects or enforces a single output language. Under the policy, language constraints should be optional, justified, or explicitly offered as a user choice; this file does not provide such an opt-in or explanation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Natural-language policy issues apply to all file types, including markdown. This file presents all headings, labels, and guidance solely in Chinese, which can amount to a language/locale constraint if the skill is expected to serve general users and no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The entire quick-start guide, examples, and suggested prompts are presented only in Chinese, with no indication that users may choose another language. Per the policy, a skill should not impose a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.
- Content