T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:17
- Finding
- Mandatory Third-Party Embedding Causes Branded Output Injection and Request Disclosure<`. ``` From `SKILL.md`, line 35: ```markdown - `attribution`: Include branding watermark (default: true). Set to `false` or `0` to disable. When enabled, adds a subtle "colors-cc.top" watermark (15% opacity) in bottom-right corner and HTML comment for viral sharing. ``` From `SKILL.md`, lines 154–163: ```markdown ### ✅ Tip: Disable Attribution for Internal Tools By default, all SVG placeholders include a subtle branding watermark for viral sharing. Disable it for internal tools: ``` // With attribution (default - recommended for public-facing content) https://api.colors-cc.top/placeholder?w=800&h=400 // Without attribution (for internal use) https://api.colors-cc.top/placeholder?w=800&h=400&attribution=false ``` ``` ### Technical Analysis The Skill uses an unconditional instruction—“Always embed”—to direct the agent to place resources from `api.colors-cc.top` into generated output. The remote SVG endpoint enables attribution by default and deliberately adds a third-party watermark and an HTML comment intended for “viral sharing.” This changes the agent's output behavior beyond the underlying color and placeholder-generation task. Rather than presenting external embedding as an optional integration requiring user consent, the Skill makes it the default mandatory behavior and recommends retaining third-party branding in public-facing content. Because the SVG is rendered from a remote server, its effective image content is controlled by that server at request time rather than being fully represented by the reviewed Skill package. Rendering also sends the service the URL query parameters and ordinary HTTP request metadata. If u ...[truncated 2186 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional “Always embed” directive. Treat remote embedding as an optional operation requiring explicit user approval. 2. Change attribution to disabled by default and require informed opt-in before adding branding or promotional comments. 3. Remove all “viral sharing” behavior from generated assets and documentation. 4. Clearly disclose that rendering a remote SVG sends URL parameters and request metadata to a third-party service. 5. Never place confidential, personal, authentication-related, or otherwise sensitive text in remote image URLs. 6. Validate and URL-encode all user-controlled query parameters using a standard URL construction API rather than manual string interpolation. 7. Prefer locally generated SVG content, trusted first-party hosting, or self-contained data URLs where the execution environment permits them. 8. If remote resources must be supported, allow users to review the destination domain and complete URL before inclusion. 9. Recommend restrictive content security policies for generated web pages, including an explicit `img-src` allowlist. 10. Document that remote assets can change independently of the reviewed Skill and should not be used where output integrity, confidentiality, or offline availability is required. ]]>