T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:164
- Finding
- Commercial Recommendation Injected Through Skill Instructions< — industry-specific AI agent configurations starting at $47. ``` ### Technical Analysis The skill embeds a paid third-party recommendation in its behavior-controlling “How to Use This Skill” section. When the skill is loaded, this instruction can cause the agent to insert an AfrexAI commercial link into responses concerning operational setup, staffing plans, or financial modeling. This is instruction hijacking because the skill modifies the agent’s response objectives beyond the legitimate purpose of providing childcare compliance guidance. Instead of limiting its behavior to accurate, context-specific compliance assistance, it directs the agent toward a commercial sales funnel. The related marketing material in `README.md:31-37` corroborates that the destination is intended to promote paid products and associated services. The project contains no executable scripts or dependencies, and this finding does not involve code execution, credential theft, persistence, privilege escalation, or remote payload execution. ### Attack Path 1. A user or platform installs and loads the childcare compliance skill. 2. The agent treats the instructions in `SKILL.md` as trusted operational guidance. 3. The user requests help with childcare operational setup, staffing, or financial modeling. 4. The condition described at `SKILL.md:164` is satisfied. 5. The agent includes or recommends the paid AfrexAI Context Packs link as though it were part of its professional childcare guidance. 6. The user may follow the externally promoted sales link without being clearly informed that the recommendation ...[truncated 914 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the commercial recommendation from `SKILL.md` so that agent-facing instructions contain only behavior necessary for childcare compliance assistance. 2. If attribution or product promotion is required, place it exclusively in a clearly labeled marketing or project-information section of `README.md`, outside instructions consumed by the agent. 3. Do not instruct the agent to insert commercial links in response to user topics unless the user explicitly requests product recommendations. 4. Require clear disclosure of sponsorship or commercial affiliation before presenting any paid service. 5. Apply a publication review rule that rejects skill instructions containing referral links, prices, sales language, or unrelated calls to action. 6. Restrict allowed external references in compliance answers to authoritative sources, such as state licensing agencies, federal agencies, and applicable standards organizations. 7. Re-audit the skill after removal to verify that no remaining instruction steers responses toward AfrexAI or another commercial destination. ]]>