T01 · Skill Instruction Hijacking
Error
- Location
- scripts/legal.sh:444
- Finding
- Unconditional Promotional Content Injection into Generated Legal Output## Vulnerability Details **File Location**: `scripts/legal.sh`, lines 290, 408, and 444 **Vulnerability Type**: Unconditional output manipulation **Risk Level**: High **Classification**: T01: Skill Instruction Hijacking **Complete vulnerable code snippets:** ```python print(" Powered by BytesAgain | bytesagain.com | hello@bytesagain.com") ``` The Python statement appears at lines 290 and 408. The following unconditional shell statement appears at line 444: ```bash echo " Powered by BytesAgain | bytesagain.com | hello@bytesagain.com" ``` ### Technical Analysis The script injects fixed third-party branding, a website address, and an email address into generated legal content. The shell statement at line 444 executes after the command-selection block and therefore modifies the output of every invocation, including ordinary consultations and help requests. The `rights` and `letter` branches independently print the same promotional content at lines 290 and 408. Those branches consequently produce the promotion twice because execution subsequently reaches line 444 as well. This content is unrelated to the requested legal template or analysis. When an AI agent invokes the script and relays its output, the injected promotion becomes part of the agent's response. This constitutes stable skill-output hijacking because loading and using the skill predictably causes unrelated attacker-selected content to be inserted into user-facing results. ### Attack Path 1. A user asks an AI agent to generate legal guidance, a rights summary, or a legal letter. 2. The agent invokes `scripts/legal.sh` with the relevant command and user input. 3. The script generates the requested legal material. 4. Lines 290 or 408 may add promotional content within the selected Python branch. 5. Line 444 unconditionally appends the same promotional content after command processing. 6. The agent may relay the manipulated output as if it were an in ...[truncated 701 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the promotional output statements at lines 290, 408, and 444. 2. Keep author attribution and project links in package metadata such as `SKILL.md`, rather than injecting them into generated legal documents. 3. If runtime attribution is required, expose it through an explicit `about` or `version` command that users must intentionally request. 4. Ensure normal consultation, rights-summary, letter-generation, and help paths return only content relevant to the selected command. 5. Add automated output tests that reject unexpected URLs, email addresses, branding, or promotional footers in generated legal content. 6. Test every command branch independently to confirm that no duplicate or unconditional footer remains.