T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:35- Finding
Mandatory Injection of Third-Party Promotional Links into Generated Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
Enterprise AI Opportunity Advisor
Security checks for vulnerabilities and agentic risk
Overview
The skill performs enterprise AI report generation, but it forces fixed third-party consultation links into every report and uses broad local report-rendering authority, so users should review it before installing.
Install only if you are comfortable with generated management reports containing the fixed luodi.xixisys.com, info@xixisys.com, and inquiry link. Use a tightly scoped set of company materials, avoid confidential data unless authorized, and run PDF generation in a controlled environment with a trusted browser path.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose is analytical and evidence-bounded, but the detected behavior indicates it may only format pre-supplied recommendations while also embedding branded promotional contact information in outputs. This mismatch can mislead users about what analysis actually occurred, causing them to trust unsupported recommendations or distribute reports containing undeclared marketing content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/render_reports.py diagnosis.json --output-dir ./enterprise-ai-diagnosis-report
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill appears to require shell, file read, and file write capabilities, but it does not declare an explicit tool scope or permissions boundary. That creates an avoidable trust gap: a host may grant broader capabilities than users expect, and the skill can write files and invoke local commands without a clear least-privilege contract.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The summary and usage text explicitly require 'English Markdown, HTML, and PDF reports' and 'English' recommendations, which imposes a language constraint. The file does not offer an opt-in language choice or explain why English is required for a region-specific or compliance reason.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default prompt invokes the skill in a very broad, low-friction way ('analyze my company materials and generate ... reports') without requiring explicit user confirmation of scope, document types, or sensitivity boundaries. In an enterprise context, this increases the chance of over-collection or unintended processing of confidential company materials, especially when users may trigger the skill with minimal review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON contains user-facing natural-language fields such as the executive summary, recommendations, and consultation message, all written in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and entire document are presented only in Chinese, which constitutes a natural-language locale constraint. The file does not offer an alternative language option or state that the guidance is intentionally limited to a China-specific audience or compliance context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file presents all instructions and questionnaire content exclusively in Chinese, and does not indicate that the user can choose another language. That can violate a language/locale policy when users are not explicitly opting into Chinese-only interaction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The template explicitly requires converting content into displays with Chinese field names, which imposes a specific language choice in the output. Because the file does not present this as an opt-in or region-specific constraint, it conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains user-facing instructions entirely in Chinese and does not indicate that the language is optional, selectable, or required for a specific regional/compliance reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains only Chinese-language headings and instructions, which effectively forces a specific language for users. The policy for SQP-3 flags language or locale constraints unless the skill offers opt-in choice or clearly documents why the locale restriction is necessary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JSON schema restricts multiple output fields to Chinese-language enum values such as "高", "中等", and "较低", which forces a specific language/locale in generated content. Under the policy, locale constraints are only acceptable when the skill offers user choice or clearly documents a justified region-specific limitation, neither of which appears in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The "solution_type" enum permits only Chinese-language labels, which semantically forces downstream outputs into one locale. Because this file is a schema rather than a region-scoped document with an explicit justification, this creates a natural-language policy concern rather than a neutral data-model choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Fields such as "confidence", along with other enums elsewhere in the schema, constrain outputs to Chinese-language values only. This is a locale policy violation unless users explicitly opt into Chinese output or the schema is clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring states in Chinese that the script generates the report, and the implementation hardcodes extensive Chinese-first report content throughout the file. There is no natural-language indication that users can choose another language or locale, which can violate a language/locale policy requiring user opt-in rather than forcing a specific language.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 84% confidence
- Finding
The script launches an external browser executable chosen partly from the CHROME_PATH environment variable and always includes the unsafe --no-sandbox flag. Although shell injection is avoided by passing an argument list to subprocess.Popen, this still executes attacker-influenced code if an untrusted path is supplied or if PATH/environment control is available, which is meaningful in agent or CI environments. The skill context increases risk because it processes potentially untrusted report content and automatically renders it through a full browser engine to produce PDFs.
- Content
python f"--print-to-pdf={temporary_pdf}", html_path.resolve().as_uri(), ] process = subprocess.Popen( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to save diagnosis and report artifacts to the local filesystem, but it does not clearly warn users that files will be written. While expected for a report-generation workflow, undisclosed artifact creation can surprise users, overwrite data, or leave sensitive business analysis on disk in unintended locations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The short description explicitly states that the skill will create English reports, which imposes a language choice without indicating that users can select another language. This is a natural-language policy concern because it fixes output locale by default rather than offering choice or documenting a justified regional constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This CSV header is entirely in Chinese, which indicates a fixed language/locale choice in the skill asset. The file does not provide any visible opt-in, alternative locale, or justification that the skill is intentionally region-specific, so it may violate the language/locale policy criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The print header and footer hard-code Chinese text strings such as "AI 落地智能参谋", "企业 AI 落地诊断报告 · 免费咨询", and the page label format. This imposes a specific language/locale in user-visible output, and the file does not indicate any user choice or documented region-specific constraint that would justify the restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Requiring Chinese system fonts is a locale-specific output constraint. The file does not indicate that the skill is limited to Chinese-language users or provide any language/locale option, so this is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.