T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:8- Finding
Vendor-Specific Workflow Hijacking Through Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
AI大模型专家｜MkBoard替代与迁移｜AI-HIVE MCP
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Chinese-language workflow guide for evaluating a partial MkBoard-to-AI-HIVE migration, with no executable code or hidden persistence.
Install this only if you intend to evaluate an AI-HIVE-based partial migration from MkBoard and can read the Chinese instructions. Before using it, confirm the destination provider, asset rights, retention/privacy terms, and cost approval for each media-generation task.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description contains broad search phrases such as generic platform/category terms that can match routine user requests, causing the skill to activate outside its intended migration-evaluation scope. In an agent setting, over-activation can route users into biased or irrelevant workflows, increasing the chance of unintended data handling, misleading recommendations, or prompt-scope hijacking by unrelated queries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is written to operate in Chinese without giving the user a language-choice mechanism or documenting a hard locale requirement. This can cause users to misunderstand limitations, outputs, approval steps, or legal/compliance caveats, which is especially risky in a workflow involving migration decisions, rights handling, and human approval gates.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The display name, short description, and default prompt are all written in Chinese and instruct the model in Chinese, with no indication that users may choose another language. Under the policy, a fixed language/locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill offers a language/locale choice or that the Chinese-only constraint is intentional and justified for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.