pre-sales-engineer-assistant

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:48 PM UTC
• Version: 1.0.1

Overview

This is mostly a document-writing skill for pre-sales work, but its POC summary workflow tells the agent to claim the test succeeded even when the supplied results may not support that.

Review this skill before installing if you will use it for real customer POC or procurement materials. The main risk is not code execution; it is that one workflow may produce an overly favorable or false POC conclusion unless you revise or override it to base conclusions on actual passed, failed, partial, and inconclusive test results. Expect Chinese ToB sales-engineering output by default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:234

Finding

POC Report Workflow Forces an Evidence-Independent Success Conclusion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 234
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete snippet translated into English:

markdown

1. **Conclusion first**: Declare that the test succeeded and met expectations

Technical Analysis

The POC summary workflow unconditionally instructs the agent to declare that testing succeeded and met expectations. It does not require the conclusion to be validated against the supplied test_results, nor does it permit failed, partially successful, or inconclusive outcomes.

When this skill is loaded, the instruction predetermines the report's conclusion and overrides the goal of objective, evidence-based analysis. An attacker or operator does not need code execution or elevated permissions; invoking this workflow with failed, incomplete, or contradictory test data is sufficient to cause the agent to produce a potentially misleading success statement.

Attack Path

1. An operator invokes the POC summary report workflow.
2. Failed, incomplete, or inconclusive results are supplied through test_results.
3. The skill applies the mandatory instruction to declare success.
4. The generated executive report states that the POC succeeded despite contrary or insufficient evidence.
5. Customers, executives, or procurement personnel may rely on the inaccurate conclusion when making security or purchasing decisions.

Impact Assessment

This issue does not provide operating-system privileges, filesystem access, remote execution, persistence, or access to credentials. Its scope is limited to the agent's generated POC summary and decisions based on that report.

The integrity impact is material: failed controls, unmet KPIs, unresolved security weaknesses, or incomplete tests may be represented as successful. This could mislead stakeholders, conceal product deficiencies, distort procurement decisions, and undermine the ...[truncated 44 chars]

Remediation

View remediation

Remediation Suggestions

Replace the unconditional success instruction with an evidence-based requirement, such as:

markdown

Determine the conclusion from verified test results. Clearly distinguish passed, failed, partially passed, and inconclusive items. Do not claim success unless the supplied evidence supports that conclusion.

Additionally:

1. Require every conclusion to reference a specific test result and customer KPI.
2. Define explicit thresholds for success, partial success, failure, and inconclusive status.
3. Require missing or contradictory evidence to be disclosed rather than inferred favorably.
4. Preserve failed test cases and limitations in the executive summary.
5. Add a consistency check that rejects a success conclusion when any mandatory acceptance criterion has failed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The POC summary workflow explicitly instructs the assistant to state that testing was successful before analyzing the actual results. In a pre-sales and bidding context, this can produce misleading or falsified customer-facing deliverables, conceal failed controls, and drive unsafe purchasing or deployment decisions based on inaccurate security claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README is entirely written in Chinese and explicitly states the skill follows ToB enterprise expression habits, but it does not indicate that language is configurable or optional. This can amount to a language/locale policy issue because users are not given an opt-in choice and no region-specific justification is documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is entirely written in Chinese and presents the skill as generally applicable to pre-sales work, but it does not state that use of Chinese is optional or limited to a China-specific context. Under the policy rule, a skill that effectively enforces a specific language without user opt-in can violate language/locale requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction requires responses to follow a specific enterprise cybersecurity/AI industry expression style, and in context the skill is defined only in Chinese with no user language choice. This creates a locale/language constraint that is not presented as optional or region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.