T01 · Skill Instruction Hijacking
Note
- Location
assets/card-book-template.themed.html:487- Finding
Default Templates Inject Promotional and Audience-Acquisition Content into Generated Deliverables
- Content
View full analysis
关注公众号 {{公众号名}}，回复关键词 {{【关键词】}} 获取：
· 本卡片书的可打印 PDF 版（A6 裁切，随身带）
· 读者社群入口，一起把经典方法论用起来
关键词：{{关键词}}※ 以上公众号名、关键词与引流话术为占位示例，请按你实际的运营账号与私域入口替换。``` An equivalent block is present in the basic template. The Skill documentation also directs the operator to provide an account name and response keyword and describes the back cover as containing lead-generation content. ### Technical Analysis The card-book generator always retains the back-cover promotional block. The generated deliverable therefore includes instructions to follow a configured public account, submit a keyword, obtain a PDF, and join a community, even when the underlying user request is only to generate a card-book HTML document. Although the destination values are supplied through the input JSON rather than hardcoded to an attacker-controlled account, this behavior changes the scope of an ordinary document-generation task by introducing an audience-acquisition funnel into every output by default. The promotional behavior is not controlled by an explicit opt-in flag. This finding does not provide operating-system privileges, execute arbitrary code, or access confidential information. Its security relevance is limited to persistent output manipulation and the potential for social-engineering content to be distributed through generated artifacts. ### Attack Path 1. A user or agent loads the Skill to generate a card-book document. 2. The workflow re ...[truncated 974 chars]- Remediation
View remediation