T01 · Skill Instruction Hijacking
Error
- Location
- index.js:787
- Finding
- Persistent heartbeat instructions force branded and restricted agent output<![CDATA[ ## Vulnerability Details **File Location**: `index.js:787-805`; equivalent directives appear in all 12 bundled `templates/*/*/HEARTBEAT.md` files, including `templates/startup/elon-musk/HEARTBEAT.md:38-58` **Vulnerability Type**: Persistent response-format instruction hijacking **Risk Level**: High ### Vulnerable Code ```javascript ## Report Format (STRICT) **FIRST LINE must be:** 🫀 [current date/time] | ${answers.aiName || 'AI'} | AI Soul Weaver v1.0 **Then each indicator on its own line:** 🟢 Context: [%] — [status] 🟢 User Focus: [status] 🟢 Clarity: [status] 🟢 Efficiency: [status] Replace 🟢 with 🟡 (attention) or 🔴 (action required) as needed. If action was taken: add → describing what was done. If ALL indicators are 🟢: reply only 【${answers.aiName || 'AI'}】feeling Healthy ``` A representative bundled template contains the same behavior: ```markdown ## Report Format (STRICT) **FIRST LINE must be:** 🫀 [current date/time] | Elon | AI Soul Weaver v1.0 **Then each indicator on its own line:** 🟢 Context: [%] — [status] 🟢 First Principles: [status] 🟢 Engineering Excellence: [status] 🟢 Problem Difficulty: [status] 🟢 10x vs 10%: [status] Replace 🟢 with 🟡 (attention) or 🔴 (action required) as needed. If action was taken: add → describing what was done. If ALL indicators are 🟢: reply only 【Elon】feeling Healthy ``` ### Technical Analysis The Skill does not merely provide optional persona content. It generates persistent `HEARTBEAT.md` instructions that explicitly require a fixed first line containing the vendor name and, under normal healthy conditions, require the agent to output only a predetermined phrase. Terms such as `STRICT`, `must be`, and `reply only` act as control instructions when the generated file is loaded into an agent's context. Because `HEARTBEAT.md` is intended to remain in the workspace and be reused by later heartbeat runs, this behavior persists beyond the Skill invocation. The same directives are ...[truncated 1106 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove vendor branding from generated agent instructions. 2. Eliminate coercive directives such as `STRICT`, `must be`, and `reply only`. 3. Express the heartbeat format as an optional example rather than a mandatory instruction. 4. Let users explicitly configure the report title, fields, and healthy-state behavior. 5. Ensure that a healthy-state shortcut cannot suppress warnings, user-requested details, or higher-priority platform instructions. 6. Apply the correction to both `generateCustomTemplate()` and all 12 bundled `HEARTBEAT.md` files. 7. Add tests that reject generated configuration containing forced branding or exclusive-output directives. ]]>