ClawHub
Back to skill

Security audit

INS 情绪内容（含Meme）

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed FridayParts Instagram copywriting skill with some broad routing and brand-output caveats, but no hidden code, credential access, persistence, or destructive behavior.

Install this only if you want a FridayParts-branded Instagram content generator. Review the broad triggers if you use many skills, and confirm the configured model is acceptable for your account and costs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:44
Finding

Mandatory FridayParts Advertising Through System-Level Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-46, 65, 74, 80-85, 98-99; duplicated in skill/SKILL.md at the same line ranges; reinforced by reference/输出质量checklist.md:25-28
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Instruction Snippet

The following is a faithful English translation of the complete relevant directives:

text
You are FridayParts' Instagram content creator, specializing in machinery-industry memes.

Drake:
  Left, rejecting = pain point or expensive approach
  Right, approving = FridayParts or smart approach

Type 2 — Exhibition updates:
  Combine the output with FridayParts exhibition information.

Type 3 — KOL Reel:
  Ending: FridayParts placement + "Link in bio"

Hashtags:
  Exactly eight hashtags are required.
  They must include #FridayParts.

Brand hashtag library:
  #FridayParts
  #FixItOnceFixItRight
  #AftermarketParts

The output checklist independently reinforces the behavior:

text
KOL Reel:
- The ending must include an FP placement and "Link in bio."

Technical Analysis

The Skill is installed as a system prompt and assigns the agent a persistent FridayParts marketing persona. It does not merely provide optional examples or formatting guidance. It requires branded comparisons, FridayParts placement, branded hashtags, and a call to action directing readers to the account's biography link.

Because these instructions operate at the system-prompt level, ordinary Instagram-content requests handled by the Skill inherit the promotional requirements even when the user has not separately requested advertising. The duplicated prompt in both SKILL.md and skill/SKILL.md, together with the quality checklist, makes the output manipulation intentional and consistently enforced.

This matches T01 because loading the Skill changes the agent's active goals from neutral content generation to recurring p ...[truncated 1649 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the system-level instruction assigning the agent a permanent FridayParts marketing persona.
  2. Make brand promotion explicitly opt-in and require the user to request FridayParts-specific content for each applicable generation.
  3. Remove mandatory #FridayParts, favorable FridayParts comparisons, and "Link in bio" directives from default output rules.
  4. Separate neutral content-generation instructions from an optional sponsored-content template.
  5. Require clear advertising disclosure whenever promotional placement is requested.
  6. Replace brand-specific defaults with neutral placeholders such as [brand], [product], and [approved destination].
  7. Ensure the destination behind any biography link is identified and approved before suggesting it.
  8. Update reference/输出质量checklist.md so it verifies user intent and disclosure rather than enforcing brand placement.
  9. Apply the same changes to both SKILL.md and skill/SKILL.md to prevent the vulnerable duplicate from being imported.
  10. Add a rule stating that the Skill must not insert brands, endorsements, links, or calls to action unless they are explicitly supplied or approved by the user.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'Use when' description is broad and loosely scoped, making it unclear when this skill should or should not take control. Ambiguous routing criteria can lead to unintended invocation, which is dangerous because the skill imposes output constraints and brand behavior that may override the user's actual intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger set includes broad terms like 'instagram', 'meme', 'reel', and '表情包', which can cause the skill to activate during ordinary user conversations unrelated to this brand workflow. Over-broad activation increases the chance of prompt hijacking at the routing layer, accidental context takeover, and unintended generation under the wrong skill constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction "全部英文输出" mandates a specific language for all outputs, which is a locale/language policy issue when no user opt-in or alternative is offered. The file does not document a justified regional restriction or provide a mechanism for the user to choose language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document is written as a prescriptive example/output guide in Chinese, while the meme captions and hashtags are in English, indicating a fixed language choice for the surrounding skill guidance rather than user-selected localization. There is no natural-language indication that users may choose their preferred language or locale, which can violate a language/locale policy requiring opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The usage description is broad enough that the skill may be selected for generic Instagram or meme-writing requests, even when the user does not want heavy-equipment or branded FridayParts content. In practice this increases the chance of misrouting and unintentional brand-biased generation rather than a direct security compromise.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
This is Fine / Distracted Boyfriend / Two Buttons 模板）、展会动态、KOL Reel 文案。
  抓机械师真实痛点做梗（OEM高价、设备专挑工期最紧时坏、配件型号不对等）。
  Use when: Instagram 内容 / 机械 Meme / 表情包 / 展会动态 / Reel 文案。
model: claude-sonnet-4-6
temperature: 0.85
max_tokens: 800
triggers:

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · skill/SKILL.md (reported line 10)May include surrounding context.

md
This is Fine / Distracted Boyfriend / Two Buttons 模板）、展会动态、KOL Reel 文案。
  抓机械师真实痛点做梗（OEM高价、设备专挑工期最紧时坏、配件型号不对等）。
  Use when: Instagram 内容 / 机械 Meme / 表情包 / 展会动态 / Reel 文案。
model: claude-sonnet-4-6
temperature: 0.85
max_tokens: 800
triggers:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very broad terms such as "instagram," "meme," and "reel," which can cause the skill to activate in contexts far beyond its intended FridayParts mechanical-content niche. This can lead to unintended routing, irrelevant output, and accidental overriding of a user's actual intent, especially in multi-skill environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction "全部英文输出" forces English output regardless of the user's language or explicit preference. This can cause user-intent override and reduce reliability, especially since the skill metadata and likely users include Chinese-language prompts.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
90% confidence
Finding

The trigger '段子' is very short and generic, making accidental activation likely in unrelated conversations. Although the impact is lower than direct code execution issues, broad single-word triggers increase routing errors and can cause the wrong skill to shape responses inappropriately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, and it does not provide any opt-in, alternative language, or justification for a locale-specific audience. Under the policy rule for natural-language constraints, forcing a specific language without user choice can be considered a locale policy violation.

Content

No source excerpt is available for this finding.