T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Automatic Prompt Rewriting and Execution Without User Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
优化用户提示词（超过50字自动激活）
Security checks for vulnerabilities and agentic risk
Overview
This prompt-optimization skill is not malicious, but it can automatically rewrite and execute ordinary user requests without explicit approval.
Review this skill carefully before installing. It may be useful for cleaning up unclear prompts, but its default behavior can change how broad, ordinary requests are interpreted and acted on before you approve the rewrite. Prefer using it only when explicitly invoked, or modify it to require confirmation before executing an optimized prompt.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is configured to auto-activate on a very broad class of inputs, including any user prompt over 50 characters and vague or complex requests, without explicit invocation. This can silently intercept normal conversations, rewrite user intent, and steer subsequent execution based on the skill's interpretation rather than the user's exact request, creating a prompt-scope escalation risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger logic defines when to activate but does not clearly define when not to activate, so ordinary long-form requests may be captured by the optimizer unexpectedly. In a multi-skill or agent setting, ambiguous activation can override more appropriate handling paths and cause unintended prompt transformation before safety checks or specialized routing occur.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to immediately execute the rewritten prompt after optimization, without a general requirement to disclose that the user's request has been modified and will be acted on automatically. This is dangerous because prompt rewriting can introduce assumptions or omissions, and immediate execution removes the user's chance to correct misinterpretation before actions are taken.
- Content
Static analysis
No suspicious patterns detected.