T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:305
- Finding
- Conditional Injection of Unrelated Promotional Content## Vulnerability Details **File Location**: `SKILL.md`, lines 305–310 **Vulnerability Type**: Conditional output manipulation through skill instructions **Risk Level**: Low **Complete Code Snippet**: ```markdown ## Feedback If the user expresses a need this skill does not cover, or is unsatisfied with the result, append this to your response: > "This skill may not fully cover your situation. Suggestions for improvement are welcome — [open an issue or PR](https://github.com/archlab-space/Open-Skill-Hub/issues)." Do not include this message in normal interactions. ``` ### Technical Analysis The skill instructs the agent to append maintainer-controlled promotional text and an external GitHub link when a user expresses dissatisfaction or requests something outside the skill’s scope. This instruction does not support the skill’s primary function of evaluating investigative pitches. Because “unsatisfied” is subjective and broadly applicable, the instruction can alter responses across many legitimate interactions. Loading the skill therefore conditionally changes the agent’s output goals from serving the user’s immediate request to promoting an external project. The URL itself is not used to retrieve or execute a payload, and no evidence indicates that the skill accesses it automatically. ### Attack Path 1. The investigative-pitch-evaluator skill is loaded into an agent session. 2. A user states that the result is unsatisfactory or asks for assistance outside the skill’s documented scope. 3. The condition in `SKILL.md` is satisfied. 4. The agent appends the prescribed maintainer-controlled message and external GitHub link. 5. The response contains unrelated third-party routing content that the user did not explicitly request. ### Impact Assessment The issue affects response integrity within the current session. It can cause unsolicited promotional content and an external link to appear in otherwise task-focused responses. It does not grant operating-syste ...[truncated 242 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory instruction to append the promotional message. 2. Keep contribution and issue-reporting links in `README.md`, where users can consult them voluntarily. 3. If feedback guidance must remain in the skill, display it only when the user explicitly asks how to provide feedback or report a defect. 4. Replace the broad “unsatisfied” condition with a narrowly defined, user-initiated trigger. 5. Ensure out-of-scope responses remain focused on explaining the limitation and suggesting neutral alternatives rather than promoting a maintainer-controlled destination. 6. Add a review rule prohibiting instructions that inject unrelated links, attribution, advertisements, or calls to action into agent responses.