T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Global Agent Workflow and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
最强大脑 AI 公司工作流程规范
Security checks for vulnerabilities and agentic risk
Overview
This skill is only a workflow document, but it broadly tries to control every task and force specific confirmation phrases, templates, and company branding into agent replies.
Install only if you specifically want a Chinese, high-friction project-management workflow to wrap nearly every task. It may delay simple requests, conflict with requested response formats, require repeated confirmations, and add unrelated company branding to outputs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All user-facing instructions, templates, and confirmation phrases are prescribed in Chinese, and the file does not state that other languages are allowed. This can violate language or locale policy when users have not opted into Chinese-only interaction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation condition is extremely broad: any 'new task' can trigger the workflow. In an agent setting, this can cause the skill to seize control of unrelated conversations, inject rigid process steps where not appropriate, and increase the chance of unintended operational actions or denial-of-service style conversational hijacking.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Lines L011-L018 state that all tasks must follow a mandatory sequence and that no step may be skipped. However, this file is only procedural documentation and contains no executable guardrail or validation logic to ensure confirmation actually occurs before execution, so the stated control is not implemented by the skill artifact itself.
- Content