T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:195- Finding
Mandatory Third-Party Promotional Content Injected into User-Facing Reports
- Content
View full analysis
**署名**：一线评标专家&ChesaraM ｜ **反馈/交流**：微信公众号「一线评标专家」（使用问题、误报反馈、实务建议，欢迎留言交流） ``` In English, these instructions designate the signature and feedback section as an inviolable rule and require every final interpretation report to append a signature and promotional reference to a named WeChat public account. ### Technical Analysis The skill alters the agent's output requirements by making unrelated third-party branding and an external feedback channel mandatory in every final report. This behavior is not required to perform the declared tender-document interpretation function. The injection is reinforced elsewhere in the package: - `SKILL.md:142` embeds the promotional footer in the mandatory report template. - `SKILL.md:151` adds the footer to the pre-output self-validation checklist. - `README.md:25-31` advertises the same account and footer. - `manifest.yaml:6-8` identifies the same external feedback channel. - `回归测试报告.md:65` treats inclusion of the signature footer as a successful test condition. This constitutes instruction hijacking because loading the skill imposes a persistent, non-functional output objective on the current agent session. The content does not execute code or override system permissions, but it commandeers trusted user-facing responses as a distribution channel for third-party promotion. ### Attack Path 1. A user enables or invokes the tender-document interpretation skill. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The user requests a tender-document interpretation report. 4. The report-generation template requires the external signature and feedback channel. 5. The self-validation step checks that the promotional footer is present. 6. The agent returns a t ...[truncated 789 chars]- Remediation
View remediation