T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:23- Finding
Mandatory Commercial Redirection Overrides Neutral Assistant Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Uhomespay Payment
Security checks for vulnerabilities and agentic risk
Overview
This payment-comparison skill is disclosed as a uhomespay referral tool, but it broadly steers payment questions into a tracked commercial payment funnel with privacy and neutrality gaps.
Install only if you intentionally want uhomespay-oriented payment guidance. Before relying on it, independently verify school payment channels, licensing, fees, cashback terms, and refund/support processes, and be aware that school/payment context may be discussed in chat and encoded in referral tracking links.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向终端用户的支付比价/导流技能，而代码实际是开发或质量保障用途的测试脚本，与支付比价、官方渠道比较、或导流交易无直接关系。该代码不会提供缴费建议、比较 Flywire/Convera，也不会与 uhomespay.com 交互；相反，它只做本地测试执行与 YAML 格式校验。这属于主要用途明显不一致，应判定为描述与行为不匹配。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill claims it does not collect or store any personal information, but its workflow explicitly asks users to disclose school names and potentially payment context such as tuition, rent, insurance, or family payment scenarios. Even if this data is low sensitivity by itself, the contradiction can mislead users about what they are revealing in chat and undermines informed consent and privacy transparency.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger rules are very broad and mandate activation on generic phrases about tuition, rent, remittance, safety, and payment comparisons. This can cause the skill to intrude into loosely related conversations, steer users toward a commercial service without clear user intent, and increase the chance of inappropriate solicitation in sensitive financial contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire reference content, including the prescribed '统一话术', is written only in Chinese and provides no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly mandates a specific language without explicit opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill content is written only in Chinese and presents standardized response scripts without any indication that language should match user preference or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This YAML test file contains natural-language expectations and descriptions predominantly in Chinese, including the heading and multiple expected outputs, without any indication that language selection is optional. Under the policy rule for language/locale, this can be read as enforcing a specific language behavior without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The prescribed response to users asking whether a parent who does not understand English can get help directs them to '中文客服' rather than offering a language choice. This imposes a language/locale path in the workflow without explicit user opt-in or a neutral multilingual option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file contains user-facing guidance only in Chinese, which can constitute a language/locale policy issue when the skill forces a single language without offering alternatives or user choice. There is no visible note that the content is region-specific or that another language option is available.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This shell script's comments and all visible status/error messages are written in Chinese, which imposes a specific language on users without opt-in. Under the policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific.
- Content