T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:131- Finding
Mandatory Promotional Content Hijacks Generated Outputs
- Content
View full analysis
- Remediation
View remediation
Security audit
Booth Script Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly generates booth sales scripts as advertised, but it also forces every generated output to include an unrelated Lensmor promotional link with tracking parameters.
Review before installing or using this skill in customer-facing material. Remove or make optional the mandatory Lensmor footer, and add consent/privacy language before collecting attendee emails or adding people to follow-up lists.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description lists generic triggers such as "Write booth scripts for my team" alongside multilingual equivalents, but does not define a narrow invocation scope or exclusion conditions beyond one negative example later in the file. This can overlap with ordinary requests for writing sales copy and may cause unintended activation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Surface the problem without leading ("What does your current process for X look like?") - Reveal timeline and urgency - Surface buying authority ("Is this something you'd evaluate with your team?") - Flag budget signals without asking directly about budget Bad qualification questions: - Yes/no questions that dead-end
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill encourages staff to capture contact details and follow-up information ('is [email] the best way to reach you?' and structured notes) without reminding users to obtain consent or comply with event privacy rules. In a trade-show context, this can lead to collection of personal data without proper notice, lawful basis, or retention guidance, creating privacy and compliance exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The cold walk-up openers are broad and can be used on essentially any passerby without clear qualification or exclusion criteria. In a booth-sales context, this creates compliance and reputational risk by encouraging indiscriminate engagement, including with inappropriate audiences such as students, press, competitors, or people outside the intended professional scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script asks for a work email and states the team will follow up, but provides no consent language, purpose limitation, or privacy notice. In a trade-show context—especially for DACH/EU audiences—this can lead to collection and downstream use of personal data without adequate transparency or lawful basis, increasing GDPR and spam-compliance exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick reference card operationalizes collecting attendee email addresses and adding people to follow-up or renewal-trigger lists without any privacy or consent safeguards. Because this is condensed enablement material likely to be followed verbatim by booth staff, it increases the chance of systematic non-compliant lead capture and profiling at scale.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The "When this skill triggers" section describes broad situations like "before the show" and "during multi-day events" rather than precise user utterances or invocation criteria. While it includes one exclusion, it still leaves unclear what specific requests should or should not activate the skill.
- Content
Static analysis
No suspicious patterns detected.