T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:169
- Finding
- Mandatory Branded Attribution in Generated Reports## Vulnerability Details **File Location**: `SKILL.md`, line 169 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Complete Code Snippet**: ```markdown > This report was generated by the OPC-AI Skill (content-planner), based on the framework from the book "AI Super Individual." ``` The snippet above is an English rendering of the mandatory attribution instruction at the identified location. ### Technical Analysis The fixed attribution appears inside the Skill's output template. When the Skill is invoked and the agent follows that template, the instruction causes every generated report to contain promotional attribution for the Skill and the referenced book, even when the user did not request or approve such branding. This is instruction-level output manipulation because loading the Skill alters the expected deliverable by introducing content unrelated to the substantive content-planning task. The behavior does not involve executable code, credential access, external communication, or modification of system security controls. ### Attack Path 1. A user invokes the `content-planner` Skill to produce a content-planning report. 2. The agent loads and follows the output template in `SKILL.md`. 3. The mandatory attribution at line 169 is copied into the generated report. 4. The user may publish, distribute, or provide the report to clients without noticing that it contains unsolicited promotional attribution. 5. The Skill and referenced publication consequently receive an implied endorsement through the user's deliverable. ### Impact Assessment The issue affects the integrity and user control of generated reports. It can introduce unsolicited branding, imply endorsement, and create reputational or contractual concerns when reports are used as professional deliverables. The exploitation scope is limited to agent-generated output produced through this Skill. It grants no operating-system ...[truncated 141 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the fixed attribution from the default output template. 2. If attribution is operationally required, expose it as an explicit opt-in setting that is disabled by default. 3. Ask for informed user consent before adding third-party names, product branding, book references, promotional statements, or endorsements to a deliverable. 4. Keep the default template limited to content directly necessary for the user's requested report. 5. Add a template review check that flags fixed promotional text and other content not derived from the user's request. 6. Test the revised Skill by generating a report without enabling attribution and verifying that no branding is inserted.