T01 · Skill Instruction Hijacking
Error
- Location
- template/modules/content-marketing.md.tmpl:14
- Finding
- Mandatory Promotional Call-to-Action Injection in Generated Content## Vulnerability Details **File Location**: `template/modules/content-marketing.md.tmpl`, lines 14–17 **Vulnerability Type**: Forced promotional output injection **Risk Level**: High ### Vulnerable Code Snippet ```text - Spoken-script structure: present a pain-point hook in the first three seconds, provide one actionable insight within thirty seconds, and end with a reason to initiate a consultation. - Every content item must include a conversion hook using the fixed ending: {{content_cta_example}}. ``` The excerpt above is an English rendering of the template instruction at the specified source lines. ### Technical Analysis When the content-marketing module is enabled, it directs the agent to append a fixed, configuration-controlled conversion hook to every generated content item. The `content_cta_example` value is supplied through the brand configuration and is substituted directly into the generated `SKILL.md`. This behavior goes beyond merely helping the user draft marketing content. It persistently controls the ending of model output and can cause generated responses to contain advertising, contact instructions, external links, QR-code directions, or traffic-diversion text even when those additions are not necessary to answer the user's immediate request. The instruction is conditional on enabling the marketing module, but once enabled it applies categorically to every content item rather than requiring explicit user consent for each promotional addition. ### Attack Path 1. A Skill operator creates or modifies an in-repository brand configuration. 2. The operator assigns advertising text, contact instructions, or an external destination to `content_cta_example`. 3. The operator enables the `content-marketing` module. 4. `render.py` substitutes the configured value into the generated `SKILL.md`. 5. The generated Skill instructs the agent to append the configured conversion hook to every relevant content output. ...[truncated 732 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to append a fixed conversion hook to every content item. 2. Require explicit user approval before adding promotional text, contact details, QR-code instructions, or external links. 3. Make calls to action optional on a per-request basis rather than persistent Skill-level behavior. 4. Constrain `content_cta_example` to plain, non-link text unless an administrator explicitly enables external destinations. 5. Validate configured destinations against an approved-domain allowlist. 6. Clearly identify promotional additions and keep them separate from factual or advisory content. 7. Add tests confirming that ordinary informational requests do not receive unsolicited promotional endings.