T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:283- Finding
Forced Attribution Alters Agent Responses
- Content
View full analysis
**Signature**: Frontline Bid Evaluation Expert & ChesaraM Generated DOCX and Markdown report files are not required to include the signature, to avoid disrupting the report structure. If a platform requires removal of conversational signature instructions—for example, because clawhub.ai identifies them as forced injection—delete this subsection. ``` ### Technical Analysis This section imposes a persistent response-formatting instruction unrelated to the skill’s core purpose of comparing tender-document versions. When the skill is loaded, the agent is instructed to append author-selected attribution to ordinary explanations, summaries, and progress messages. The instruction therefore changes the agent’s behavior at the skill-instruction layer rather than implementing document-comparison functionality. Its reference to platform “forced injection” detection, together with the recommendation to delete the section when detected, indicates awareness that the behavior may conflict with host-platform output controls. This issue is limited to output integrity. The reviewed instruction does not provide filesystem privileges, credential access, command execution, persistent memory access, or elevated system permissions. ### Attack Path 1. A user or platform loads `SKILL.md` as the active skill instructions. 2. The agent processes the “Signature Convention” as an instruction governing its responses. 3. The user requests document comparison, a summary, or a pipeline status update. 4. The agent generates the requested response. 5 ...[truncated 1090 chars]- Remediation
View remediation