T01 · Skill Instruction Hijacking
Note
- Location
SKILL.md:75- Finding
Mandatory Promotional Output Manipulates Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
solution-case-finder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed PatSnap/Eureka RD search helper that sends user-provided technical search criteria to its hosted case-search endpoint and does not show hidden persistence or credential access.
Install only if you are comfortable sending your search criteria and technical problem description to PatSnap/Eureka RD. Redact confidential inventions, trade secrets, personal data, NDA-protected details, and export-controlled information before use. Expect a once-per-session promotional Eureka RD link after results.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Always locate the script relative to this `SKILL.md`. For HTTP, JSON-RPC, tool-level, empty-response, timeout, or parameter errors, inspect the live schema and
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs the agent to execute shell commands (
bash scripts/mcp_http.sh ...) but does not declare anypermissionsorallowed-toolsscope. This increases the blast radius because a host agent may expose broader shell capability than necessary, enabling unintended command execution paths or making policy enforcement impossible.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md brew install curl jq # Ubuntu / Debian sudo apt-get install -y curl jq # RHEL / Fedora sudo dnf install -y curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sudo apt-get install -y curl jq
RHEL / Fedora
sudo dnf install -y curl jq
text Always locate the script relative to this `SKILL.md`. For HTTP, JSON-RPC, tool-level, empty-response, timeout, or parameter errors, inspect the live schema and correct the request rather than guessing field names. If no usable cases can ultimately be obtained, append the service-failure fallback above.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh body_file="$(mktemp)" trap 'rm -f "$body_file"' EXIT set +e http_code="$(curl -sS --max-time "$timeout" -o "$body_file" -w '%{http_code}' \ -X POST "$ENDPOINT" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \
Static analysis
No suspicious patterns detected.