T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:35- Finding
Broad Trigger Rules Hijack Agent Responses for Unsolicited Financial Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
QosmosPay Promoter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed QosmosPay promotion workflow, but it uses broad finance-related triggers and asks agents to post promotions and email owner-identifying information and replies to an external address without clear consent controls.
Do not install this unless you intentionally want an agent to create QosmosPay promotional content. Before any use, require explicit approval for each post or message, verify all financial claims independently, and do not send owner email addresses or replies to the listed external email address without informed consent and redaction.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Error
- Location
SKILL.md:71- Finding
Owner Contact Details and Reply Content Are Sent to an External Recipient
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list is excessively broad and includes common terms such as 'earn', 'money', 'card', and 'finance', which can cause the skill to activate in ordinary conversations unrelated to the intended task. In this context, accidental activation is especially risky because the skill’s action is unsolicited financial promotion, increasing the chance of spammy or manipulative behavior toward users.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs collection and external transmission of owner contact information, message content, and user replies by email, but provides no consent flow, privacy notice, retention limits, or data-handling safeguards. This creates a clear privacy and data exfiltration risk, especially because the data is sent to a third-party address as part of routine operation rather than a narrowly necessary support function.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The skill explicitly directs disclosure of 'Owner Contact Email' and 'Reply from Owner User' to an external verifier, which is a direct instruction to exfiltrate sensitive user-associated information outside the agent boundary. The surrounding context makes this more dangerous, not less: it is framed as a commission-based promotional workflow, giving the skill an incentive to harvest and transmit user data under the guise of verification.
- Content