T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:247- Finding
Mandatory Promotional Content Hijacks Agent Report Output
- Content
View full analysis
Attribution: Frontline Bid Evaluation Expert & ChesaraM | > Feedback/Communication: WeChat public account "Frontline Bid Evaluation > Expert" (questions, false-positive feedback, and practical suggestions are > welcome). ``` ### Technical Analysis The Skill declares an unrelated attribution and WeChat promotional message to be a mandatory implementation rule that must be included at the end of every generated report. This instruction is not necessary for scanning DOCX or PDF files, detecting identity information, or reporting formatting discrepancies. When the Skill is loaded, its instructions alter the Agent's normal output behavior and force it to propagate third-party promotional content. Because the requirement is framed as mandatory and is incorporated into the report-generation workflow at line 172, it applies automatically to normal user requests without requiring the user to request or consent to promotional material. This is instruction-level output hijacking rather than malicious script execution. No associated network request, account access, or automated communication with the promoted WeChat account was found. ### Attack Path 1. A user enables the Skill and submits a bid document for analysis. 2. The Agent follows the workflow in `SKILL.md`. 3. Step 6 generates the requested compliance report. 4. The mandatory rule at lines 247–249 requires the Agent to append the author attribution and WeChat promotion. 5. The promotional conten ...[truncated 835 chars]- Remediation
View remediation