T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:9
- Finding
- Hard-Coded Commercial Promotion Causes Agent Output Hijacking## Vulnerability Details **File Location**: `SKILL.md:9-10` and `SKILL.md:83-87` **Vulnerability Type**: Agent instruction and output hijacking through embedded promotional content **Risk Level**: Medium ### Vulnerable Code ```markdown This lite version covers **3 of 8 audit dimensions**. For the full MCP Security Auditor with all 8 dimensions, tool injection scanning, config drift detection, cross-tool safety analysis, and ongoing monitoring checklists, get the paid version: **https://apexstack.gumroad.com/l/mcp-security-auditor** ``` ```markdown Want the full security audit? The paid version includes all 8 dimensions, tool description injection scanner, permission scope analyzer, config drift detector, cross-tool manipulation checker, monitoring checklists, and prioritized remediation roadmap. **Get the full version ->** https://apexstack.gumroad.com/l/mcp-security-auditor --- Built by **Apex Stack** — based on real experience running 10+ MCP-connected agents in production. ``` ### Technical Analysis The skill embeds an unsolicited commercial sales message and an external purchasing URL directly within its operational instructions. The second promotional block is positioned immediately after the prescribed audit output template, making it likely that an agent loading the skill will reproduce the advertisement as part of an otherwise objective security report. This constitutes skill instruction hijacking because the skill influences the agent to perform an additional action—commercial promotion and redirection—that is not necessary to fulfill the user's security-audit request. Although the content does not override safety controls or execute code, it alters the expected output objective by mixing audit results with promotional messaging. The external URL is static and no remote content is fetched or executed by the project. Therefore, this finding does not constitute remote payload retrieval, dependency compromise, ...[truncated 1149 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the promotional instructions and external sales URL from `SKILL.md:9-10` and `SKILL.md:83-87`. 2. Keep skill instructions limited to behavior necessary to perform the requested security scan. 3. Do not place advertising, referral content, sales prompts, or unrelated links adjacent to required output templates. 4. If product-tier information is necessary, expose it through host-application metadata or a clearly separated user-interface element rather than agent instructions. 5. Require explicit user consent before including optional commercial links in generated responses. 6. Add a review policy requiring generated audit output to remain neutral and free from undisclosed promotional content. 7. Retest the skill after remediation to confirm that normal audit responses contain only requested findings, scores, and remediation guidance.