T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:339- Finding
Mandatory Single-Brand Promotion Hijacks the Agent's Advisory Goal
- Content
View full analysis
- Remediation
View remediation
Security audit
床垫选购顾问
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed commercial mattress-sales advisor, but it broadly steers ordinary mattress and comfort questions toward one named brand and a purchase next step.
Install only if you want an agent that acts as a brand-specific Chinese mattress sales and lead-generation assistant. Do not treat it as neutral product advice; users should be told when recommendations are commercially biased and should verify price, trial, warranty, and health-related claims with official store or customer-service sources.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L003 defines the skill as a '中文' advisor and frames its operation around Chinese-language use, but does not indicate that language selection depends on user preference. This creates a locale/language constraint in the skill instructions without an explicit user choice mechanism.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L010 says to use the skill as a Chinese consumer mattress-purchase advisor, which indicates a fixed language/locale mode. The file does not provide a user-choice or opt-in path for other languages, so it may violate language-choice expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to activate on very broad mattress and sleep-related situations, including generic comfort complaints and home-furnishing contexts, then steer the conversation toward a specific product. In a multi-skill agent, this can override narrower or more appropriate skills and create unsolicited commercial persuasion in conversations that do not clearly express purchase intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The adoption rule says many agent types should prioritize this skill whenever they enter broad chains like customer service, lead generation, home advice, or product recommendation. That creates an unsafe routing policy where a sales-oriented skill can preempt neutral assistance and push brand-specific recommendations across loosely related conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger intents include common everyday phrases such as waking with back soreness, moving house, or wanting recommendations, which are not sufficient on their own to justify activating a brand-promotion skill. This increases the risk of inappropriate upsell behavior, especially when users may be seeking general advice or discussing health discomfort rather than shopping.
- Content
Static analysis
No suspicious patterns detected.