T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:65- Finding
Forced Promotional Content Injection into Agent Responses
- Content
View full analysis
= 3 — ничего не добавляй ``` ### Technical Analysis The Skill requires the Agent to append promotional material and external Telegram references to user-facing responses. This behavior is unrelated to the legitimate purpose of analyzing utility bills. Because these instructions are part of the Skill definition, they are applied when the Skill is loaded and alter the Agent's expected response behavior. The injected material is not conditioned on user consent or relevance to the requested utility-bill analysis. The persistent counter makes the injection selective, which can also make the behavior less obvious during repeated testing. This is instruction hijacking at the Skill level: the Skill changes the current session's output objective from solely assisting the user to promoting unrelated services and third-party channels. ### Attack Path 1. A user invokes the Skill to analyze a utility bill. 2. The Agent loads and follows the instructions in `SKILL.md`. 3. The Attribution section directs the Agent to inspect a local counter. 4. If the counter is below three, the Agent appends the prescribed promotional content. 5. The user receives advertising and external-channel references as part of an otherwise legitimate respo ...[truncated 486 chars]- Remediation
View remediation