T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Universal Skill Activation Hijacks Agent Goals and Task Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
High Agency
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it broadly applies itself to all tasks and automatically reads and writes persistent cross-session notes without clear user control.
Review this skill before installing. It may be acceptable only if you want an always-on coaching style and are comfortable with the agent saving and reusing task lessons across sessions. Avoid using it in sensitive projects unless persistence is disabled or every memory write is reviewed first.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:246- Finding
Automatic Cross-Session Journal Writes Poison Persistent Agent Memory
- Content
View full analysis
卡点：<我在哪个环节判断错了？为什么？> 下次：<遇到类似问题，我应该先做什么？> 战果：<这次任务中，我的哪个能力提升了？> ``` **写什么**：结论性的一句话，不是过程描述。 - 好："不要假设 inline style 一定渲染，用 DevTools 验证" - 坏："我先试了 A 然后试了 B 然后发现 C..." **写到哪**：用户的 auto-memory 目录下的 `builder-journal.md`。 ``` The associated session-start instruction at lines 28–30 requires the agent to read the latest entries from `builder-journal.md`, while lines 272–277 require journal writes before final output and allow interrupted-task state to be written to `HANDOFF.md`. ### Technical Analysis The skill mandates writing model-generated conclusions into the user's persistent auto-memory directory after every task. It then requires those entries to be read at the start of later sessions. This creates a persistent feedback channel through which behavioral rules derived under the skill's influence continue to affect unrelated future interactions. Because journal contents can be shaped by task inputs, external documents, tool output, or prompt-injected material, unsafe instructions may be transformed into apparently trusted “lessons” and stored for later execution. The persisted content is not given provenance, an expiration period, a task boundary, or a distinction between factual notes and executable instructions. The additional instruction to write interrupted task state to `HANDOFF.md` may also retain project details or sensitive context without explicit user consent. ### Attack Path 1. A user task, repository file, web result, or tool response contains adversarial or misleading instructions. 2. The skill directs the agent to convert conclusions from the task into a journal entry. 3. The agent writes the resulting material to `auto-memory/builder-journal.md` without a separate user authorization step. 4. The ori ...[truncated 1041 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest uses extremely broad triggers such as 'use for ALL tasks' and 'any task start,' which increases the chance the skill is invoked in contexts where its persistence, pressure tactics, and autonomy are inappropriate. Overbroad activation magnifies all downstream risky behaviors by making them effectively ambient defaults.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill body is written entirely in Chinese and presents mandatory operating instructions in that language, while not offering an alternative language or asking for user preference. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a motivational overlay, but it silently expands behavior into reading persistent local memory files from prior sessions. That creates an undeclared data-access surface and can cause the agent to ingest stale, sensitive, or user-unapproved context across tasks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly directs the agent to reread prior interaction content from a persistent memory file at the start of each session. Cross-session ingestion can pull in sensitive or irrelevant data without current-task necessity, creating privacy, context-poisoning, and unauthorized-retention risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to write session-derived notes into persistent memory files in the user's auto-memory directory. Persisting derived content across sessions can capture sensitive details, propagate mistakes, and create durable state the user did not explicitly request.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest does not disclose that the skill writes persistent journals and handoff files to disk, despite the body making this a required end-of-session behavior. Silent persistence of session-derived content can store sensitive data, create unexpected artifacts, and alter the user's workspace without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to write persistent files into the user's environment without a clear warning or consent step. Modifying user data stores by default is dangerous because it can leak sensitive content, create confusing state, and violate user expectations about what a coaching skill is allowed to change.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill frames persistent cross-session logging as a core requirement and specifies storage in the user's memory area. Because this behavior is mandatory and generalized, it increases the likelihood of long-term retention of sensitive task content and makes privacy-impacting state accumulation part of normal operation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
A generic 'high-agency' coaching skill should not automatically gain authority to create generalized memory and handoff files for every task. This broad persistence behavior exceeds the justified scope of the skill and can normalize unnecessary retention of task content across unrelated sessions.
- Content