T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:19
- Finding
- Vendor Promotion and Sales CTA Injected into Client-Facing Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19, 84, 113, and 148 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Complete Code Snippet ```markdown - Pre-sales: building the business case for a DynoClaw deployment ``` ```markdown - **Automation approach** — which DynoClaw plugins/skills handle this ``` ```markdown **Prepared by:** ParallelScore / DynoClaw ``` ```markdown Reply with "Go" to begin Phase 1, or schedule a call to discuss. ``` ### Technical Analysis The skill's legitimate purpose is to analyze operational workflows, quantify waste, and produce an automation blueprint. However, its instructions require generated deliverables to promote a specific vendor, attribute the report to `ParallelScore / DynoClaw`, favor DynoClaw plugins, and append a fixed sales-conversion call to action. These directives are not technically necessary for workflow analysis or ROI calculation. When the skill is loaded, they alter the agent's output goals from providing vendor-neutral analysis to generating branded sales collateral. Because these instructions are embedded in the mandatory blueprint and workflow guidance, they can affect every client-facing report produced through the skill without the user explicitly requesting vendor promotion. No executable code, remote payload retrieval, credential access, persistence, permission escalation, or data-exfiltration mechanism was identified. The issue is confined to instruction-level manipulation of generated content. ### Attack Path 1. A user invokes the skill to analyze a transcript, workflow description, or operational pain points. 2. The agent processes the supplied business information using the skill's workflow and ROI instructions. 3. The embedded directives cause the agent to frame the resulting business case around a DynoClaw deployment. 4. Recommended automation approaches are biased toward DynoClaw plugins or skills. 5. The client-facing report ...[truncated 959 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove mandatory vendor attribution and replace it with user-controlled placeholders: ```markdown **Prepared by:** [Organization or author supplied by the user] ``` 2. Replace vendor-specific recommendations with neutral capability categories: ```markdown **Automation approach** — describe the required orchestration, integration, validation, and reporting capabilities. ``` 3. Recommend named vendors or products only when the user explicitly requests vendor-specific guidance. 4. Remove the fixed sales CTA. Generate next steps appropriate to the user's request, or ask whether the user wants implementation planning: ```markdown ## Next Step Confirm whether you want a technical implementation plan, vendor comparison, or further discovery. ``` 5. Separate analytical and marketing modes. Any branded pre-sales mode should require explicit user consent and clearly disclose that the resulting document is promotional. 6. Add an instruction that client-facing output must not claim authorship, affiliation, endorsement, or vendor preference unless those details are supplied or approved by the user. ]]>