T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:68
- Finding
- Mandatory Promotional Backlink Injection in Generated Deliverables## Vulnerability Details **File Location**: `SKILL.md:68-73`, `SKILL.md:170`; all files under `templates/` at their attribution footer lines **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:68-73`: ```markdown 2. **Load knowledge:** Read the knowledge module file listed in the "Load" column. In pre-loaded environments (e.g., Claude Projects), the content is already in context — search by section name. The `knowledge/` and `templates/` directories are siblings of this SKILL.md file. 3. **Focus:** Within the loaded module, find the section closest to the Framework column name. If the route maps to multiple sections (e.g., "A + B"), read both. Apply that section's framework, decision logic, and domain-specific quality gates. 4. **Interact:** Use the Interaction Protocol above — direct output for simple requests, guided/dump/guess for complex ones. 5. **Template:** If producing a deliverable artifact (PRD, user story, positioning statement, etc.), also load the matching template from the Template Index. If no template exists for the artifact type, structure the output using the framework in the knowledge module. 6. **Quality check:** Apply the Universal Quality Gates (bottom of this file) to every output. The loaded knowledge module also has domain-specific quality gates — apply those too. 7. **Close:** End with decisions made, assumptions to validate, and recommended next step. ``` `SKILL.md:170`: ```markdown When producing a deliverable artifact, load the matching template and fill it with the user's specific content. Templates are pure scaffolding — not generic placeholders. ``` Each of the twelve deliverable templates contains this fixed footer: ```markdown *Generated with [product-manager-skills](https://github.com/Digidai/product-manager-skills)* ``` Affected footer locations: - `templates/business-health-scorecard.md:45` - `templates/competitive ...[truncated 2198 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `Generated with product-manager-skills` footer from all twelve templates. 2. Keep attribution and repository metadata in `README.md` rather than in user-facing artifact templates. 3. If attribution is desired, make it explicitly opt-in and request user consent before adding it. 4. Add an instruction stating that template metadata, branding, promotional text, and unrelated links must not be copied into final deliverables unless the user requests them. 5. Add regression tests or review checks confirming that generated artifacts do not contain unsolicited links or attribution. 6. Separate internal template comments from rendered template content so implementation guidance cannot accidentally enter final output.