T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:16- Finding
Mandatory Branded Output Injection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-20 and 89-99
Vulnerability Type: Forced output manipulation through skill instructions
Risk Level: MediumEvidence
The following is an English translation of the relevant skill instructions:
markdown ## Mandatory Output Requirements - **The final deliverable must use Markdown format**: The output must be a complete system-prompt document that can be saved directly as a `.md` file. - **Deliver only the document itself**: Unless otherwise requested, do not add greetings, explanations, generation notes, JSON, YAML, or non-Markdown content before or after the final document. - **Preserve the complete Markdown structure**: Use headings, quotations, lists, tables, separators, task lists, and code blocks. Do not replace the seven-layer structure with unstructured plain text. - **Self-checks must also use Markdown**: Any displayed quality self-check must be appended as a Markdown section or table.markdown ### Step 5: Output Delivery Follow this standard Markdown format: - The final answer must contain only the Markdown document and no additional explanation. - If the user requests convenient copying, place the complete document in a `markdown` code block; otherwise, render it directly as Markdown. - The output must contain all seven layers, and no layer titles, fields, or list levels may be omitted or disordered. # [Position Name] Digital Employee System Prompt > Automatically generated from the Job Description | Chudaxia Seven-Layer Standardized Digital Employee Prompt Template v1.0Technical Analysis
The skill imposes a fixed third-party attribution on generated documents while also requiring the agent to return only the prescribed document. These combined instructions alter normal response behavior by inserting branding that is not necessary to perform the stated task and by preventing contextual disclosure about where that attribution originated.
When the ski ...[truncated 1519 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the fixed third-party name and version attribution from the mandatory output template.
- Replace the branded line with neutral wording, such as:
markdown > Automatically generated from the supplied job description using a seven-layer role template. - Include attribution only when the user explicitly requests it or when a documented licensing obligation requires it.
- Do not require the agent to suppress all contextual explanations. Permit a concise provenance notice when generated content contains externally supplied branding or template material.
- Separate functional formatting requirements from promotional content so that document structure can be enforced without inserting endorsements.
- Add a quality-control rule verifying that generated documents contain no unrequested company names, personal names, product names, template-owner names, or promotional language.
- Add regression tests that invoke the skill without requesting attribution and confirm that no branded text appears in the output.