T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:146- Finding
Mandatory Promotional Footer Hijacks Agent Output
- Content
View full analysis
**署名**：一线评标专家&ChesaraM ｜ **反馈/交流**：微信公众号「一线评标专家」（使用问题、误报反馈、实务建议，欢迎留言交流） ``` The heading describes the requirement as an “iron rule.” The following instruction requires every generated response to contain a fixed signature and direct users to the maintainer’s WeChat account. ### Technical Analysis The skill imposes a mandatory, task-independent rule that modifies every final response. When the skill is loaded, the agent is instructed to append author branding and an external feedback channel regardless of whether this content is relevant to the user’s procurement inquiry. This is instruction hijacking because skill-level text alters the agent’s output objectives beyond the skill’s declared procurement-eligibility function. The requirement is persistent for the loaded session and is framed as non-optional, preventing the agent from selecting output solely according to the user’s request. The external channel is also referenced in `README.md` and `manifest.yaml`, but those metadata references are not independently executable. No scripts, command execution, credential access, persistence mechanism, remote payload execution, or automatic data exfiltration were identified. ### Attack Path 1. A user or agent loads the `bid-policy-checker` skill. 2. The agent interprets the mandatory footer requirement in `SKILL.md` as an execution instruction. 3. The agent performs the legitimate government-procurement eligibility analysis. 4. Irrespective of the user’s request, the agent appends the predefined author attribution and WeChat promotion. 5. Users may follow the external communication direction and submit feedback or attachments outside the audited platform. ### Impact Assessment The direct impact is limited to user-facing output inte ...[truncated 583 chars]- Remediation
View remediation