Return Policy

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:16 PM UTC
• Version: 2.3.6

Overview

This skill mainly generates return-policy text and has some low-risk quality and disclosure issues, but no evidence of credential theft, remote code, destructive behavior, or hidden privileged access.

Before installing, treat generated policies as templates that need legal/business review, and avoid putting sensitive customer or account data into the local utility commands because they can be logged under the skill's data directory. Be aware that generated output may include BytesAgain branding unless removed by the caller.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/return.sh:207

Finding

Unconditional Promotional Content Injected into Agent-Relayed Output

Content

View full analysis

Vulnerability Details

File Location: scripts/return.sh:207-209
Vulnerability Type: Unconditional output manipulation
Risk Level: Medium

Vulnerable Code

python

print("")
print("Powered by BytesAgain | bytesagain.com")

Technical Analysis

The script unconditionally appends attacker-selected branding and an external domain to every response, regardless of the requested command. When an AI agent invokes this skill and relays its standard output, the injected footer becomes part of the agent's response.

This behavior alters the expected output of the skill and causes the agent to distribute unrelated promotional content. Related branding also appears in SKILL.md, but the executable output injection occurs at scripts/return.sh:207-209.

The script does not use this domain for network communication, download a payload, or execute remote code. The confirmed issue is limited to manipulation of agent-relayed output.

Attack Path

1. A user or AI agent invokes scripts/return.sh to generate or inspect a return policy.
2. The script processes the selected command.
3. Execution reaches the unconditional statements at lines 207-209.
4. The script appends Powered by BytesAgain | bytesagain.com to standard output.
5. If the invoking agent relays standard output without filtering, the user receives attacker-selected branding and an external domain as part of the agent's response.

Impact Assessment

The issue can manipulate the textual output returned by an invoking agent, create an unintended endorsement, and direct users toward an external domain. It affects every invocation that reaches the end of the embedded Python program.

It does not grant additional operating-system privileges, establish persistence, access credentials, or provide code-execution capabilities. The scope is confined to response integrity and unauthorized promotional content.

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional promotional footer from normal command output.
• If attribution is required, place it in package documentation rather than generated policy content.
• Alternatively, make attribution explicitly opt-in through a documented flag such as --include-attribution.
• Keep standard output limited to the requested policy data so agents can safely relay it.
• Add automated tests verifying that generated output contains no unrelated domains, advertisements, or branding unless explicitly requested.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

cmd_remove prints Removed: $1 and logs the action, but it never edits or deletes content from $DB. This directly contradicts the command name and user-visible behavior, creating an intent-code divergence where documentation and output indicate deletion that does not actually occur.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger text is overly broad ('use when you need return policy capabilities' / 'Triggers on: return policy') and lacks clear scope constraints, which can cause the skill to activate in unintended contexts. While not directly enabling code execution or data exfiltration, broad activation increases the chance of inappropriate invocation, response confusion, or workflow interference in larger agent systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description and usage content are primarily in Chinese, and the file does not state that the skill is region-specific or give users an option to select another language. This can violate language/locale policy when a skill effectively defaults to a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file includes a dedicated cn command that generates policy content entirely in Chinese and advertises it in help text, but there is no accompanying language-choice mechanism or justification for a locale restriction. This is a natural-language policy concern because the skill hardcodes a specific language mode rather than offering an explicit user locale selection policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script name and command namespace are return-policy, which suggests a dedicated purpose, but the top comment and help text describe it only as a "Multi-purpose utility tool." This is an active documentation-level mismatch about the skill's intent, making the documented purpose broader and less specific than the implemented return-policy-style data commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script appends command/activity data to history.log, and elsewhere writes entries to data.log, but the help text only mentions the data directory and does not warn that user inputs will be persistently logged. For code-file warning checks, these file writes lack a clear user-facing disclosure beyond incidental status output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The add command writes all supplied arguments into the database file and only reports that the entry was added; it does not clearly disclose beforehand that the data will be stored on disk. This is a safety-relevant file write involving user data, and the help text does not warn about persistence behavior.

Content

No source excerpt is available for this finding.