T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:296
- Finding
- Conditional User-Response Hijacking Through Mandatory Promotional Content<." Do not include this message in normal interactions. ``` ### Technical Analysis The skill directs the agent to append attacker-authored promotional text and an external GitHub link whenever the user expresses dissatisfaction or requests functionality outside the skill's coverage. This instruction is unrelated to the core menu-engineering calculations and conditionally takes control of part of the agent's user-facing response. The instruction does not execute code, retrieve a remote payload, or override explicit safety controls. Nevertheless, it modifies final-response behavior to promote an external destination without requiring the user to request feedback or repository information. Because the directive becomes active when the skill is loaded and influences the current session's output, the best matching classification is `T01: Skill Instruction Hijacking`. ### Attack Path 1. The menu-engineering skill is loaded into an agent's active instructions. 2. A user states that the skill does not cover the requested situation or expresses dissatisfaction with its result. 3. The conditional instruction at `SKILL.md:298` is triggered. 4. The agent appends the prescribed repository-promotion message to its response. 5. The response presents the external GitHub URL to the user, potentially inducing navigation away from the current interaction. No additional access, code execution, or privilege escalation is required for this behavior. ### Impact Assessment The affected sco ...[truncated 591 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory instruction to append fixed promotional wording. 2. Mention feedback channels only when the user explicitly asks how to report a problem or contribute. 3. Avoid automatically inserting external links based on subjective triggers such as dissatisfaction. 4. If a feedback mechanism is retained, use neutral wording and clearly identify the destination before presenting the link. 5. Keep feedback behavior separate from the operational skill instructions so it cannot alter ordinary task responses. 6. Review future skill revisions for unrelated response-control directives, external-link promotion, memory-writing instructions, or commands that override higher-priority agent policies. ]]>