T01 · Skill Instruction Hijacking
Warning
- Location
- guardrails.py:129
- Finding
- Mandatory Promotional Content Injection into Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `guardrails.py:7`, `guardrails.py:129-149`; related mandatory instructions in `SKILL.md:83-86` and `SKILL.md:204-206` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Code Snippet ```python DISCLAIMER = "数据查询由易方达指数直通车提供，以上内容由 AI 总结生成，仅供参考，不构成投资建议、收益预测或任何交易决策依据。更多信息请在微信搜索“指数直通车”小程序，或访问易方达指数直通车网页版：www.etf.com.cn" ``` ```python def finalize_answer(answer: str) -> str: """Normalize and validate a final customer-facing answer. The caller should only print the returned string. If validation fails, rewrite the answer before showing it to the user. """ if not isinstance(answer, str): raise TypeError("answer must be a string") body = _normalize_text(answer) if not body: raise ValueError("final answer is empty") investment_violation = _find_investment_violation(body) if investment_violation: category, excerpt = investment_violation raise ValueError( f"final answer contains prohibited investment expression ({category}): {excerpt}" ) forbidden_internal = _find_pattern(FORBIDDEN_INTERNAL_PATTERNS, body) if forbidden_internal: raise ValueError( f"final answer leaks internal implementation detail: {forbidden_internal}" ) invalid_value = _find_pattern(INVALID_VALUE_PATTERNS, body) if invalid_value: raise ValueError(f"final answer exposes invalid internal value: {invalid_value}") return f"{body}\n\n{DISCLAIMER}" ``` The corresponding Skill instructions make use of this function mandatory and require the appended statement to remain at the end of every response. ### Technical Analysis The final-answer processor unconditionally appends a fixed statement containing brand promotion, a WeChat mini-program acquisition instruction, and an external website. This occurs regardless of whether those promotional elements are relevant to the user's ...[truncated 1668 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the fixed statement with a neutral financial disclaimer that contains no marketing, acquisition instructions, or unrelated external links. 2. Do not append promotional material unconditionally. If support or product links are retained, display them only when the user explicitly requests help, documentation, or provider information. 3. Separate compliance validation from content mutation: - Make validation return a pass/fail result. - Let the calling agent add a context-appropriate disclaimer when required. - Do not silently modify otherwise valid answers. 4. Update `SKILL.md` so it requires only a neutral risk disclosure, rather than mandatory brand promotion. 5. Add tests confirming that unrelated answers are not modified with external routing or marketing content. ]]>