T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:56- Finding
Mandatory Branding Injection into Generated Output
- Content
View full analysis
- Remediation
View remediation
Security audit
萃书
Security checks for vulnerabilities and agentic risk
Overview
This book-summary skill is mostly coherent, but it tells the agent to automatically run a local Node file-transfer command and send the generated image without confirmation.
Review before installing. The summarization and infographic behavior is understandable, but you should only use this skill if you are comfortable with it attempting to send generated images through POPO automatically. Prefer requiring explicit confirmation and a visible recipient before any file transfer.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs sending the generated image immediately and not waiting for confirmation. Combined with external file transfer, this removes a key consent checkpoint and can result in unintended disclosure, wrong-recipient delivery, or abuse of the agent to perform side effects the user did not fully authorize.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L003 将触发范围定义为“帮我萃取/总结/提炼某本书的精华”“要求生成书籍信息图”“想快速了解一本书的核心内容”等宽泛表述，这些短语与常见日常请求高度重叠，缺少明确边界。文档也未提供排除条件或负例，难以判断何时应调用该技能、何时不应调用。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L055-L056 规定“正文语言：大部分使用中文”，属于对输出语言的强制约束，但文档未说明这是用户可选项，也未表明仅适用于特定地区或场景。根据规则，未提供语言/locale 选择或合理限定时，属于自然语言策略违规。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill goes beyond generating a summary/infographic and instructs the agent to invoke an external Node script to transfer a file directly to a recipient. That creates an exfiltration/action surface outside the declared skill scope, and the placeholder arguments and could be populated from context in unsafe ways, enabling unintended file delivery or disclosure without explicit user confirmation.
- Content