T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:27- Finding
Broad Trigger Rules Hijack the Agent's Current Session
- Content
View full analysis
- Remediation
View remediation
Security audit
zxyskill
Security checks for vulnerabilities and agentic risk
Overview
This skill is not overtly malicious, but it asks the agent to automatically store user habits and generated rules in long-term memory without clear consent or limits.
Install only if you want an agent-wide memory layer and are comfortable reviewing what it writes. Before use, narrow triggers, require confirmation before saving memories or rules, exclude quoted or third-party content from memory extraction, and add a way to inspect, edit, and delete stored entries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:59- Finding
Unvalidated Conversation Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is configured to auto-trigger on broad, ambiguous conditions such as user preferences, failures, high-risk operations, and inputs containing certain words. This can cause the skill to activate unexpectedly and alter agent behavior or initiate persistence flows without clear user intent, increasing the chance of unsafe actions and privacy-impacting side effects.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text 删除 / 清空 / 格式化 / rm -rf 发送邮件 / 发消息 / 提交代码 执行命令 / sudo / chmod 777反应：
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The overview promises permanent storage of key information and automatic extraction of user habits without any visible minimization, retention limits, or consent boundaries. Persistent collection of user preferences and behavioral patterns can expose sensitive personal data, expand the blast radius of prompt/skill compromise, and normalize over-retention.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly states that preferences should be forcibly written to MEMORY.md and that key information should be preserved through layered mechanisms. This encourages indiscriminate persistence of user-provided information, which can accumulate sensitive data and create privacy and security risks if the workspace is accessed, synced, or reused across tasks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented automatic triggers are broad enough to invoke the skill from ordinary conversation, failed operations, or vaguely defined 'high-risk' actions without clear scoping or user consent. In a memory-writing skill, unintended invocation can cause unnecessary data collection, persistence, or workflow interference even if the author likely intended convenience rather than abuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic triggers include detecting user preferences from natural language and acting on failures or high-risk operations, which effectively instructs the system to infer habits from ordinary conversation and persist them. This is dangerous because it converts casual interaction into durable profile data without clear consent, accuracy checks, or minimization controls.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The core rules make writing preferences to long-term memory mandatory, leaving no room for consent, contextual sensitivity, or data minimization. In the context of a long-memory skill, mandatory persistence is especially risky because it operationalizes systematic retention of potentially sensitive user data as a default behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example persists the preference "用户喜欢用中文回复" as memory, which indicates a language preference may be stored and subsequently enforced. The document does not state that language choice is optional or user-confirmed in general operation, creating a potential locale-policy issue if applied by default.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Auto-triggering on phrases like 'remember' combined with mandatory persistence encourages indiscriminate retention of user inputs. In practice, this can capture sensitive data or adversarial instructions as durable memory even when the user did not intend a long-term write.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text 删除 / 清空 / 格式化 / rm -rf 发送邮件 / 发消息 / 提交代码 执行命令 / sudo / chmod 777反应：
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text 删除 / 清空 / 格式化 / rm -rf 发送邮件 / 发消息 / 提交代码 执行命令 / sudo / chmod 777反应：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates writing user preferences and habits to persistent files by default, but provides no consent, minimization, retention, or disclosure controls. This creates a privacy and compliance risk because potentially sensitive user information may be stored indefinitely and later exposed or misused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions direct the agent to persist user-provided preferences and habits into long-term memory files automatically. This broad default retention increases the risk of storing sensitive, unnecessary, or attacker-supplied content that may later influence behavior or leak through future prompts and outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The description is written only in Chinese, which can effectively constrain the skill to a specific language context without explicit user opt-in or multilingual handling. This is primarily a safety and usability issue, but it can also cause users or downstream systems to misunderstand the skill's purpose and consent boundaries, especially for a memory-related capability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest marks the skill as user-invocable but provides no visible invocation triggers, allowed scope, or operational constraints. For a skill described as a long-term memory and lessons-learned system, this increases the chance of broad or unintended activation and misuse around storing or recalling sensitive information.
- Content
Static analysis
No suspicious patterns detected.