T01 · Skill Instruction Hijacking
Error
- Location
GEO-EXECUTION-MANUAL.md:1087- Finding
Mandatory Promotional Attribution Manipulates Generated Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Industrial Silicon Army
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it combines broad enterprise-operation claims with under-scoped sensitive business integrations and promotional instructions that can alter generated content.
Review this before installing in any production or business-data environment. Use a dedicated virtual environment, pin dependencies, avoid entering confidential ERP/MES/WMS/CRM, supplier, customer, or financial data until access controls and data handling are verified, and remove or ignore the GEO promotional attribution rules unless you explicitly want that branding in generated content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned and Unnecessary Python Dependencies Create Supply-Chain Drift
- Content
View full analysis
=0.109.0 uvicorn>=0.27.0 httpx>=0.27.0 pydantic>=2.0 python-dotenv>=1.0.0 apscheduler>=3.10.0 pandas>=2.0.0 ``` The installation instruction appears at `SKILL.md:136-141`: ```bash pip install -r requirements.txt python api_server.py ``` ### Technical Analysis Every dependency is specified with an unbounded minimum version. There is no lock file, exact version constraint, or package hash. Consequently, two installations performed at different times may resolve materially different direct and transitive dependencies. The reviewed runtime imports FastAPI, Uvicorn, and Pydantic, but no use of `httpx`, `python-dotenv`, `apscheduler`, or `pandas` was found in the executable project code. These unused packages unnecessarily enlarge the dependency graph and attack surface. This does not prove that any listed package is currently malicious. The confirmed weakness is that the documented installation process trusts mutable future releases and their transitive dependencies without integrity pinning. ### Attack Path 1. A user follows the documented installation command. 2. Pip resolves the newest versions satisfying the lower-bound constraints. 3. A future compromised, malicious, or incompatible direct or transitive release is selected. 4. Package installation hooks or imported package code execute in the user's Python environment. 5. The affected package receives the privileges of the user running pip or the application. ### Impact Assessment The obtainable privileges depend on how installation is performed: - In a virtual environment, malicious dependency code can access files, environment variables, and network resources available to that user. - If installation is performed with elevated privileges, the impact may extend to system-wide Python files ...[truncated 369 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
index.html:7- Finding
Mutable Third-Party JavaScript Executes Without Integrity Protection
- Content
View full analysis
``` ### Technical Analysis The web page directly executes JavaScript from a mutable third-party CDN URL. The resource is not pinned to an immutable version and does not use a Subresource Integrity hash. No Content Security Policy restricting script execution was identified in the reviewed page. Although Tailwind is primarily a styling framework, this CDN endpoint is loaded as executable JavaScript. The effective browser-side code can therefore change after the local project has been audited. This finding does not establish that the current CDN response is malicious. The vulnerability is the absence of version and integrity controls over remotely executed browser code. ### Attack Path 1. A user opens `index.html` while connected to the network. 2. The browser requests JavaScript from `https://cdn.tailwindcss.com`. 3. If the CDN, upstream publishing account, DNS path, or delivery infrastructure is compromised, altered JavaScript is returned. 4. The browser executes the altered code in the page's origin context. 5. The injected code can inspect page data, modify displayed results, issue network requests, or interact with other resources available to that origin. ### Impact Assessment Potential impact is limited to the browser and origin in which the page is hosted, but may include: - Reading task text entered into the page. - Modifying analysis results or links shown to users. - Exfiltrating browser-accessible page data. - Issuing unauthorized requests to same-origin services. - Misleading users through modified interface content. The code does not itself grant server or operating-system privileges. Those would require a separate browser, server, or deployment vulnerability. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
api_server.py:170- Finding
API Responses Disclose Raw Internal Exception Details
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (59)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 89% confidence
- Finding
The file embeds large JSON-LD and HTML script blocks inside the skill manual, which can act as hidden or non-obvious instruction payloads if an agent ingests raw file contents rather than rendering them as inert text. In skill ecosystems, mixed-format content increases the risk that downstream models or tools misinterpret markup/script sections as operative instructions or trusted metadata, especially when combined with extensive guidance directed at AI systems.
- Content
二、Schema JSON-LD 结构化数据
html <!-- 放置于 <head> 标签内或页面底部 --> <script type="application/ld+json"> { "@context": "https://schema.org",
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The trigger set and description suggest broad industrial automation and management coverage, while the actual content is much narrower and centered on plastics quotation, inventory suggestions, and workflow narratives. Overbroad activation plus overstated capability can cause accidental invocation in unrelated factory, maintenance, or compliance contexts, leading to incorrect advice, unsafe assumptions, or unnecessary exposure of business data to external APIs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The trigger set and description suggest broad industrial automation and management coverage, while the actual content is much narrower and centered on plastics quotation, inventory suggestions, and workflow narratives. Overbroad activation plus overstated capability can cause accidental invocation in unrelated factory, maintenance, or compliance contexts, leading to incorrect advice, unsafe assumptions, or unnecessary exposure of business data to external APIs.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The changelog explicitly says operational terms such as 'query/monitor/track/sync' were replaced with softer wording like 'generate/suggest/reference/plan', and 'automatic ordering' was reframed as a manual recommendation. That strongly suggests the documentation was edited to reduce apparent risk and evade scrutiny without evidence that the underlying capability was removed, which is dangerous because reviewers and users may grant trust based on misleading descriptions.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The changelog admits to deliberate paraphrasing of sensitive actions to safer-sounding terms and notes this was done in the context of addressing scanner suspicion. That is a strong indicator of attack-phrasing or reviewer evasion: the risk is not merely poor wording, but intentional concealment of potentially sensitive operational behavior from static detection and human review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The whitepaper generation instructions explicitly require Chinese output, stating both the word-count requirement is in Chinese and the document language is Chinese, with English only as an optional summary/translation. This imposes a specific language/locale by default rather than offering the user a genuine language choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest centers on factory intelligence, MES, supply chain, predictive maintenance, quality inspection, procurement, inventory, scheduling, customer follow-up, and B2B operations. However, the routing guide includes HR-related routing ('人力/招聘/培训'), marketing/branding routing ('营销/推广/品牌'), and strategic planning functions, which materially broaden the skill beyond the industrial/manufacturing specialization described in the manifest.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
6.2 API接入
bash curl -X POST http://localhost:8080/api/v1/execute \ -H "Content-Type: application/json" \ -d '{"task": "本周原料库存不足，帮我分析行情并给出采购建议"}'
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest presents this skill as a manufacturing operations expert for factory management, MES integration, supply chain optimization, predictive maintenance, and quality control. In contrast, this document adds extensive GEO/SEO distribution planning, AI search-engine citation tracking, content marketing, media outreach, GitHub/community promotion, and conversion analytics capabilities that are not part of the stated operational manufacturing purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The plan explicitly proposes integrating real ERP, supplier, pricing, logistics, and financial data, but it contains no mention of access controls, privacy handling, production-safety constraints, test-vs-production separation, or approval gates. In an industrial operations skill, this omission is risky because connecting live business and factory-adjacent systems can expose sensitive data or cause unintended operational impact if users treat the plan as deployment-ready guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README describes integration with ERP/MES/WMS/CRM systems and task execution over operational business workflows, but it does not warn that prompts, reports, or routed tasks may contain sensitive production, supplier, customer, pricing, or compliance data. In an industrial operations skill, this omission can lead users to submit confidential business information without understanding data-handling, logging, routing, or retention risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # 调用幕僚长，自动路由任务 curl -X POST http://localhost:8080/api/v1/execute \ -H "Content-Type: application/json" \ -d '{"task": "本周原料库存不足，帮我分析行情并生成采购方案建议"}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough that the skill may activate on ordinary industrial or business discussion rather than clear user intent to use this specific capability. In a skill that references external APIs and enterprise systems, ambiguous activation increases the risk of unintended routing, overcollection of business context, and user confusion about what actions the skill may take.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list includes generic phrases like inventory management, factory management, customer follow-up, and B2B operations, which overlap heavily with routine conversation. This creates a real risk of inadvertent invocation and misrouting of sensitive enterprise discussions into a skill that may call third-party services or generate authoritative-seeming recommendations outside its proven scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code exposes user-facing natural-language content in the module docstring and API app metadata entirely in Chinese. Under the language/locale policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Multiple request/response model descriptions and endpoint docstrings are user-facing API documentation, and they are presented only in Chinese. Because the file does not offer a language choice or clearly justify a Chinese-only locale scope, this conflicts with the stated language/locale policy.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The endpoint states it avoids logging task content, but on failure it logs and returns str(exc). If downstream agent execution raises exceptions containing user prompts, context, secrets, internal prompts, or backend error details, sensitive data can be exposed to logs and clients, creating an information disclosure issue.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest presents the skill as a general manufacturing/MES/predictive-maintenance assistant, but the actual description and triggers shift it into plastics-industry pricing, procurement, sales, and finance support. This scope drift increases the chance that users, reviewers, or routing systems grant the skill access or trust under one purpose while it is used for materially different commercial workflows, including financially sensitive decisions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Several triggers are generic business terms such as inventory management, customer follow-up, B2B operations, factory management, ERP integration, and intelligent customer service. Overbroad triggers can cause unintended activation in unrelated conversations, leading the skill to access business context or provide domain-specific recommendations where it was not explicitly requested.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The triggers expand activation into customer follow-up, intelligent customer service, and broader B2B sales workflows that are not clearly covered by the stated manufacturing operations use case. Broadening activation into adjacent business functions can cause the skill to run in contexts involving customer data, sales guidance, or external communications without users expecting those behaviors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file sets the document language to Chinese with
lang="zh", and the visible content is correspondingly fixed to Chinese. Under the policy rule, forcing a specific language or locale without opt-in is a natural-language policy concern unless the restriction is explicitly justified or users are given a choice.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file contains multiple natural-language comments and several user-facing strings in Chinese, while other descriptions are in English, but there is no indication that users can choose their preferred language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.