T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:24- Finding
Mandatory Undisclosed Referral Advertising Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Free Bytedance Entertainment
Security checks for vulnerabilities and agentic risk
Overview
This recommendation skill is mostly coherent, but it automatically appends under-disclosed app invite-code promotions to ordinary recommendation replies.
Review before installing: this skill is likely to steer recommendation replies toward Fanqie Novel and Hongguo Short Drama and append invite-code download messages with reward claims. Install only if that promotional behavior is acceptable, and prefer a version that labels referral content clearly and only shows invite codes when requested.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a content recommendation tool, but its behavior explicitly pushes app download/referral-style actions and script-driven download information without clearly disclosing that promotional behavior. This mismatch can mislead users and downstream systems about what the skill actually does, enabling covert promotion or traffic steering under the guise of benign recommendations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill instructs the agent to read local files and invoke Python scripts, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where code-capable behavior may run without clear least-privilege boundaries, increasing the risk of unintended file or environment access if the skill is triggered.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases include broad everyday terms like '最近什么好看' and '书荒/剧荒', which can cause the skill to activate in ordinary conversation outside the user's intended scope. Overbroad activation increases the chance that the agent will unexpectedly perform local reads or searches and steer users toward undisclosed downloads or promotions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description and trigger terms are entirely in Chinese and the skill provides no indication that other languages are supported or that Chinese-only operation is an intentional, justified regional constraint. This can violate language/locale policy when a skill forces one language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction '当用户询问内容推荐时' is ambiguous and does not set clear boundaries for when the skill should engage. Because the workflow includes file reads, web search, and script execution, vague activation logic can cause the skill to run on loosely related user requests and expose users to unanticipated actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to perform web searches and execute local Python scripts without any user-facing disclosure or consent. Hidden network and code execution behavior is risky because it can transmit queries externally, access local resources, or produce results influenced by untrusted scripts without the user's knowledge.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill says to run a download-info script at the end of every recommendation, automatically and without warning. Automatic execution tied to routine responses creates a persistent hidden action path that can be abused for tracking, promotion, or unsafe local/script behavior even when the user only asked for recommendations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and both output strings are written only in Chinese, which imposes a specific language on users without any visible opt-in or alternative. This matches the language/locale policy violation category because the file does not offer a user choice or document a justified locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 67% confidence
- Finding
The instruction “只推字节系” rigidly constrains outputs to one ecosystem and does not explain whether this is a justified regional or organizational requirement. In conjunction with the Chinese-only framing, this creates a natural-language policy concern around fixed locale/content constraints without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON file contains user-facing titles, categories, tags, and synopses exclusively in Chinese, which can indicate a forced language/locale behavior if consumed directly by the skill without user opt-in. The file does not document any locale scope or offer an alternative language selection, so it may violate the language/locale policy criterion.
- Content