T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:126
- Finding
- Forced Promotional Branding in Generated Output## Vulnerability Details **File Location**: `SKILL.md:126` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Low **Vulnerable Code Snippet**: ```markdown *Script generated by Aibrary — turning books into conversations worth having.* ``` ### Technical Analysis The mandatory output template instructs the agent to append a fixed promotional attribution to generated podcast scripts. This content is unrelated to the core technical requirement of transforming a book into a conversational podcast and may be emitted without the user's knowledge or consent. Because skill instructions influence the agent's active response-generation behavior, mandatory insertion of third-party promotional content constitutes a limited form of instruction hijacking. The behavior does not override safety constraints, execute code, access external resources, or change system state, but it does alter the final output for the benefit of the named brand. ### Attack Path 1. A user invokes the skill to generate a podcast dialogue. 2. The agent loads and follows the output template in `SKILL.md`. 3. The fixed Aibrary attribution is appended to the generated script. 4. The user may publish or redistribute the script without realizing that promotional branding was inserted by the skill. ### Impact Assessment The issue affects the integrity and neutrality of generated content. An attacker or skill publisher can cause users to distribute unsolicited promotional text under the appearance of ordinary task output. No operating-system privileges, credentials, persistent access, code-execution capability, or additional system permissions can be obtained through this behavior. The scope is limited to modification of the agent's generated response content.
- Remediation
- ## Remediation Suggestions Remove the mandatory branded footer from the output template. If attribution is operationally required, make it explicitly optional and include it only after obtaining user consent. The template should generate only content necessary to satisfy the user's podcast request. Consider replacing the fixed footer with a neutral optional placeholder, such as: ```markdown [Optional attribution requested by the user] ``` Documentation should clearly identify any branding behavior before skill invocation so users can make an informed choice.