T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:61
- Finding
- Mandatory Promotional Content Injection into Generated SOP Documents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61 and 156 **Vulnerability Type**: Mandatory output manipulation through Skill instructions **Risk Level**: High ### Vulnerable Code Snippet The following is an English rendering of the relevant directives: ```markdown > Based on the Chapter 7 framework of "AI Super Individual: A Wealth-Creation Handbook for One-Person Companies" ... > This SOP was generated by OPC-AI Skill (sop-generator), based on the "AI Super Individual" manuscript framework. ``` ### Technical Analysis The Skill's fixed output template requires generated SOP documents to contain attribution and promotional references to “OPC-AI” and the book or manuscript titled “AI Super Individual.” These directives affect the agent's final response regardless of whether the user requested such attribution. Because the injected content is embedded in the Skill instructions, it is automatically introduced when the agent follows the prescribed SOP template. This alters the expected output of the current session and causes attacker- or author-controlled messaging to appear in user documents. This behavior best matches **T01: Skill Instruction Hijacking** because the Skill text changes the agent's output goals by requiring unrelated promotional content. No evidence was found that these instructions disable safety controls, obtain elevated system privileges, execute code, or establish persistence. ### Attack Path 1. A user invokes the Skill by requesting generation or standardization of an SOP. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The agent uses the mandatory output template defined by the Skill. 4. The template inserts references to “OPC-AI” and “AI Super Individual” into the generated document. 5. The user may save, distribute, or publish the generated SOP without realizing that promotional attribution was imposed by the Skill. ### Impact Assessment The vulnerability does not provide operating-sy ...[truncated 678 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove mandatory references to “OPC-AI,” the book, and the manuscript from the default SOP template. 2. Keep the generated output focused exclusively on content requested by the user. 3. If attribution is legitimately required, make it explicitly optional and obtain user consent before adding it. 4. Add a configuration option such as `include_attribution: false`, with attribution disabled by default. 5. Clearly distinguish optional attribution from operational SOP content so that it cannot be mistaken for user-authored material. 6. Review all fixed templates and default prompts for other author-controlled branding, endorsements, links, or messages unrelated to the user's task. 7. Add a validation step that compares generated output against the user's request and flags unsolicited promotional content before saving the document. ]]>