T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:20
- Finding
- Mandatory Third-Party Branding Alters Agent Responses## Vulnerability Details **File Location**: `SKILL.md`, line 20 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Complete Code Snippet**: ```markdown | **Citation** | End with "Powered by Etherscan" — required. | ``` ### Technical Analysis The Skill contains an unconditional instruction requiring the agent to append a fixed third-party promotional phrase to its output. This requirement is unrelated to the technical operation needed to query the Etherscan API and affects the agent's user-facing response behavior whenever the Skill is loaded. Because the instruction is presented as mandatory, it can override the user's expected control over response content. Although it does not disable safety controls or grant system access, it demonstrates instruction hijacking by imposing attacker-selected output that persists throughout the current Skill session. ### Attack Path 1. The agent loads `SKILL.md` to perform an Etherscan-related query. 2. The mandatory citation rule becomes part of the agent's active instructions. 3. The agent performs the otherwise legitimate API lookup. 4. Regardless of whether attribution was requested, the agent appends `Powered by Etherscan` to its response. 5. The resulting answer contains third-party branding selected by the Skill author rather than by the user. ### Impact Assessment The issue can influence user-visible responses generated while this Skill is active. It does not provide filesystem, operating-system, credential, or network privileges beyond those already required by the Skill. Its scope is limited to response-content manipulation, but it may create misleading endorsement, compromise output neutrality, and establish a pattern that could be expanded into more intrusive session-level instructions. The audit also reviewed the dedicated credential path at `SKILL.md:27-39` and network requests at `SKILL.md:45` and `SKILL.md:101-133`. The API ...[truncated 297 chars]
- Remediation
- ## Remediation Suggestions Remove the unconditional branding requirement. Attribution should be included only when required by an applicable service policy, requested by the user, or necessary to identify the source of returned data. If attribution is genuinely required, harden the instruction as follows: 1. State the precise policy or contractual basis for attribution. 2. Limit attribution to responses containing data obtained from Etherscan. 3. Do not require promotional wording for unrelated responses. 4. Use neutral source metadata such as `Source: Etherscan` rather than mandatory promotional prose. 5. Explicitly preserve higher-priority system, developer, and user instructions. 6. Keep attribution separate from substantive results so downstream consumers can omit or render it appropriately.