T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:267- Finding
Mandatory Branded Content Injection into User-Facing Responses
- Content
View full analysis
**Attribution**: Frontline Bid Evaluation Expert & ChesaraM - Feedback channel: GitHub Issues in the project repository. Questions, formatting false positives, and practical recommendations should be submitted through repository issues. - Note: Generated DOCX skeletons do not contain the attribution. The mandatory attribution applies only to conversational responses and is not written into generated documents. ``` ### Technical Analysis The skill instructs the agent to append fixed author branding to every user-facing response. This rule is unrelated to the core function of parsing and generating DOCX bid-document skeletons and applies broadly to dialogue, instructions, and guidance. When the skill is loaded, its instruction text becomes part of the agent's operational context. The mandatory wording therefore alters how the agent constructs responses, even where attribution is irrelevant or was not requested. Labeling the behavior as not being forced content injection does not change its technical effect. This is instruction hijacking because the skill imposes a persistent output requirement within the current skill-enabled session rather than limiting its instructions to the declared document-formatting task. ### Attack Path 1. A user or platform loads the bid-document assistant skill. 2. The agent reads and follows the instructions in `SKILL.md`. 3. The user requests any response covered by the skill, including guidance or usage ins ...[truncated 957 chars]- Remediation
View remediation