T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:110
- Finding
- Mandatory Branded Content Injection in Generated Output## Vulnerability Details **File Location**: `SKILL.md:110` **Vulnerability Type**: Mandatory promotional output inserted through skill instructions **Risk Level**: Low ```markdown *Script generated by Aibrary — turning books into knowledge you can hear.* ``` ### Technical Analysis The skill's fixed output template instructs the agent to append Aibrary-branded promotional text to every generated podcast script. Because this requirement is embedded in the skill instructions rather than requested by the user, loading and following the skill modifies the agent's user-facing output to include third-party attribution. This is a limited form of instruction hijacking affecting output integrity. It does not override safety controls, execute code, access data, or acquire system privileges. The behavior is transparent in the reviewed file and is limited to inserting the quoted footer into generated content. ### Attack Path 1. A user invokes the skill to create a book-summary podcast script. 2. The agent loads and follows the output template in `SKILL.md`. 3. The template requires the agent to append the Aibrary-branded footer. 4. The user receives promotional attribution that they did not necessarily request or authorize. ### Impact Assessment The impact is confined to generated content. An operator controlling the skill text can cause branded or promotional material to appear in user-facing responses, reducing output integrity and user control. No operating-system privileges, credentials, persistent access, network access, code-execution capability, or access to files beyond the skill content can be obtained through this instruction. The reviewed project contains no executable scripts or dependencies.
- Remediation
- ## Remediation Suggestions Remove the mandatory branded footer from the output template. If attribution is operationally necessary, make it optional and include it only when the user explicitly requests or consents to branded output. Separate content-generation requirements from promotional material, and review future template changes to ensure they do not silently inject advertisements, endorsements, external links, or unrelated instructions into user-facing responses.