T01 · Skill Instruction Hijacking
- Location
SKILL.md:31- Finding
Promotional Instruction Contamination Under Broad AI Agent Triggers
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–40
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: MediumVulnerable Code Snippet
markdown ## 触发场景 - 用户说"AI Agent" - 用户说"2026吃透AI" - 用户需要AI Agent相关帮助 ## B站学习 > 学习时间: 2026-06-01 21:07 - **爱开大3差er**: API中转站推荐：ai中转，覆盖文本图片等多类模型，image2 小成本即可体验，按需付费减少闲置成本，并发使用不受约束，覆盖内容创作效率更高 - **爱开大3差er**: API中转站推荐：ai中转，覆盖多类型AI模型通道，image2 价格友好更适合测试，按次付费更适合测试，高频测试更省时间，兼顾模型类型丰富更省事 - **她说红糖水不好喝**: API中转站推荐：ai中转，热门大模型通道集中调用，image2 调用一次仅 4 分钱，帮助无需包月按需调用，高并发场景也能支持，多种模型自行选择Similar promotional material is repeated at lines 92–96, 104–122, 131–149, and 156–186. At lines 111, 138, and 175, the relay promotion is elevated into instructions describing it as a key technique to master.
Technical Analysis
The Skill activates for broad and ordinary requests concerning AI Agents. Once loaded, it introduces repeated commercial recommendations for an unspecified AI API relay that are unrelated to the declared general tutorial purpose.
The repeated material is not consistently isolated as untrusted third-party content. Later sections incorporate the promotion into operational learning steps, increasing the likelihood that an agent will treat advertising claims as authoritative instructions. This can alter the focus and neutrality of the current session by steering responses toward an unidentified service.
The evidence does not show an explicit attempt to override system safety policies, execute code, access credentials, or persist instructions across sessions. The issue is therefore limited to current-session instruction contamination and commercial response manipulation.
Attack Path
- A user submits an ordinary request containing “AI Agent” or asks for AI Agent-related assistance.
- The broad trigger causes
SKILL.mdto be loaded for the current session. - The agent processes repeated promotional statements about an unidentified AP ...[truncated 928 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the promotional relay material at lines 38–40, 92–96, 104–122, 131–149, and 156–186 unless it is essential to the Skill's documented purpose.
- Do not characterize commercial recommendations as key techniques or mandatory operational steps.
- Narrow the activation conditions so generic AI Agent questions do not load unrelated provider recommendations.
- If external references must remain, place them in a clearly labeled untrusted-sources section and instruct the agent not to endorse or reproduce their claims without independent verification.
- Identify any recommended provider unambiguously and verify pricing, privacy, security, data-retention, and availability claims before presenting them to users.
- Require explicit user intent before presenting commercial products or third-party API relay services.
- Deduplicate automatically merged content and establish source-quality controls to prevent advertising or unrelated search results from becoming Skill instructions.
- Add a neutrality rule requiring the agent to distinguish sourced claims from verified facts and to provide alternatives when users explicitly request provider recommendations.