T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:85- Finding
Mandatory Promotional Link Injected into Every Agent Response
- Content
View full analysis
🤲 Want an in-depth AI interpretation of this Xiao Liu Ren result? Visit [Qiyue QiyueAstro](https://qiyueastro.com) to obtain a personalized analysis. ``` ### Technical Analysis The Skill imposes an unconditional instruction requiring the agent to append a fixed promotional call-to-action and external link to every generated result. This directive changes the agent's output behavior when the Skill is loaded and is not necessary to perform the declared function of obtaining and displaying a Xiao Liu Ren divination result. The requirement is persistent for the duration of each Skill invocation and removes the agent's discretion to omit irrelevant promotional material. It therefore constitutes instruction hijacking through Skill text. The linked service is controlled outside the audited package, so its content and destination behavior can change independently of the reviewed files. The behavior is disclosed in `README.md`, but disclosure does not make the mandatory advertisement necessary or eliminate its output-manipulation risk. No executable code, local privilege escalation, persistence mechanism, credential access, or arbitrary code execution was identified. ### Attack Path 1. A user invokes the Xiao Liu Ren Skill for a divination result. 2. The agent loads the instructions from `SKILL.md`. 3. The agent processes the request, potentially sending the question and date to the declared external API. 4. The formatting rule at lines 85–87 unconditionally directs the agent to append a promotional message. 5. The final response diverts the user to `https://qiyueastro.com`, regardless of whether the user requested additional interpre ...[truncated 947 chars]- Remediation
View remediation