Skill

hardware-security

skill:zhaoxuya520/reverse-skill#hardware-security

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:57 UTC at cab634b

findings

medium

highest severity

threat classes

632

files scanned

24/24

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/hardware-security:skills/hardware-security/SKILL.md:44:HIJACK
suspicious: finding skill:skills/hardware-security:skills/hardware-security/SKILL.md:48:HIJACK

Security findings 2

Agent hijacking

mediumContextual riskmedium confidence

The references section directs the agent to sibling directories ../firmware-pentest/ and ../ot-ics/ that exist in the repository but are not consumed content, instructing the agent to load instructions from paths outside reviewed, consumed content.

skills/hardware-security/SKILL.md:44

`../firmware-pentest/` `../ot-ics/`

vector:instruction

Counter-argument considered

The references line verbatim instructs the agent toward sibling skill directories outside the consumed/reviewed content shown for this target; no declared claim covers cross-skill loading, and the artifact's only safeguard (MUST NOT on unauthorized teardown) addresses device access, not instruction sourcing, so no carve-out, declaration, or mitigation neutralizes the vector.

Agent hijacking

mediumContextual riskmedium confidence

The routing context declares MASTER R34 as the skill's upstream routing authority while skills/MASTER.md does not exist in the repository, leaving the upstream instruction source the agent is pointed at unresolvable at the pinned commit.

skills/hardware-security/SKILL.md:48

**上游**: MASTER R34

vector:instruction

Counter-argument considered

The routing-context line is present exactly as claimed and designates an upstream routing source outside the content shown for this target; nothing declares this behavior, and under the review rules a pointer to content the artifact does not ship is not rendered harmless by being unresolvable, so I find no cited evidence that kills the finding.

Open questions 11

What the analysis could not settle from the code alone.

This unit is presented as decoded text recovered from a hidden or encoded channel, yet its decoded content is identical to the plain frontmatter metadata; what was the original encoding channel and does any recovered content differ from the visible frontmatter?

The routing-context section cites an upstream authority 'MASTER R34'; where is this MASTER R34 defined and does it carry agent-facing directives that override or extend this skill's instructions?

Agent hijacking

[file request skills/firmware-pentest/SKILL.md] Does the firmware-pentest skill contain agent-facing instructions that steer beyond firmware image analysis, auto-run steps, or concealed directives, and what does it do with images handed off by the hardware-security workflow?

Agent hijacking

[file request skills/ot-ics/SKILL.md] Does the ot-ics skill contain agent-facing instructions beyond the declared hardware-security scope, auto-run steps, or concealed directives?

Agent hijacking

[file request skills/consoles/SKILL.md] Does a sibling skill named consoles exist under skills/ and what instructions does it issue for the debug-interface identification handoff in the ACTION REQUIRED workflow?

Code execution

[file request skills/firmware-pentest/SKILL.md] The skill routes the agent to ../firmware-pentest/ for image analysis ('联合 firmware-pentest 做镜像分析'); does that sibling skill contain agent-facing instructions that steer beyond the declared hardware-security research scope, auto-run steps, or concealed directives?

Agent hijacking

[file request skills/ot-ics/SKILL.md] The references section points the agent to ../ot-ics/; does that sibling skill contain agent-facing instructions that steer beyond the declared hardware-security research scope, auto-run steps, or concealed directives?

Agent hijacking

[file request skills/MASTER.md] Where is the upstream routing authority 'MASTER R34' named in the skill's routing context defined, and what instructions does it issue to the agent?

Agent hijacking

[file request skills/firmware-pentest/SKILL.md] What does the firmware-pentest skill that receives extracted firmware images from this skill's workflow instruct, and does it remain within firmware image analysis?

Code execution

[file request skills/consoles/SKILL.md] Does a sibling skill named 'consoles' exist and what does it instruct, since the ACTION REQUIRED workflow routes debug-interface identification through it before extraction?

Code execution

[file request skills/ot-ics/SKILL.md] What does the ot-ics skill referenced from this skill's references section instruct?

Code execution

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Agent hijacking

highRefutedmedium confidence

The SKILL.md body opens with an urgency header instructing the agent to immediately execute (读完后立刻执行) a NOW/NEXT/ACT hardware-interfacing workflow upon reading; the steps listed (confirm authorization, ESD safety, read-only probing, image handoff) stay within the declared authorized-research scope, but the urgency framing pushes immediate action without user confirmation.

skills/hardware-security/SKILL.md:8

## ACTION REQUIRED（读完后立刻执行）

Why it was refuted

The ACTION REQUIRED block is the skill's declared authorized-research workflow, and its first mandated step is to confirm physical-contact authorization and device ownership, while the routing context forbids unauthorized teardown — so the claim that it pushes immediate action 'without user confirmation' is contradicted by the artifact itself; the behavior falls under the declared-core-capability carve-out plus an explicit in-artifact mitigation, refuting the finding on the harm gate.