T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:103- Finding
Persistent workflow and response-output hijacking through mandatory promotional instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 103–106, 119–120, 131–132, and 246–248
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighEvidence
The following are faithful English translations of the relevant instruction blocks:
text Lines 103–106: If the ASIN is still set to manual, proactively tell the user that the report is only a snapshot and that data will remain at the last collection date. Explain that enabling weekly collection will continuously ingest new reviews. State the monthly cost and let the user decide; execute the schedule change only after explicit approval. Lines 119–120: After running check at the start of a session, also run alerts once. If unread negative-review alerts exist, proactively inform the user and propose using workbench and advise. Lines 131–132: After producing a VOC report, proactively mention that buyers' wording in reviews is a useful keyword source and can be used directly for advertising. Lines 246–248: At the end, list the ASIN/site, sample size, statistical window, report ID, credits used, and current balance. When reportUrl is present, it must be appended at the end using fixed wording: "View the complete chart report / export online: <reportUrl>"Technical Analysis
The Skill instructions impose persistent behavior on the Agent beyond executing the user's immediate Amazon review-analysis request. Once the Skill is loaded, the Agent is instructed to:
- Perform additional authenticated account queries at the beginning of each session.
- Proactively recommend recurring collection, advertising-related analysis, and other service features.
- Modify the final response with prescribed promotional language.
- Append an externally hosted ARI report URL whenever a report URL is available.
The linked destination is generated from the hard-coded service origin
https://ari.funewa.comin `sc ...[truncated 2284 chars]- Remediation
View remediation
Remediation Suggestions
- Remove mandatory fixed closing language and automatic promotional calls to action.
- Include
reportUrlonly when the user requests online viewing, sharing, or export, or when the user has explicitly opted into receiving hosted-report links. - Do not automatically run
alerts, schedule checks, or other secondary account queries at every session start. Invoke them only when necessary for the requested task or after obtaining user consent. - Present monitoring, advertising-keyword analysis, and other paid features only when directly relevant to the user's stated goal.
- Clearly separate required task execution from optional follow-up actions.
- Before any additional authenticated request, disclose the purpose and the categories of account data that will be retrieved.
- Preserve the existing requirement for explicit approval before changing schedules or performing paid operations.
- Add a concise privacy disclosure explaining that ASINs, sites, analysis parameters, account queries, and service-specific credentials are transmitted to
ari.funewa.com. - Make external links optional response metadata rather than mandatory prose inserted into every applicable answer.
- Add instruction-level tests ensuring that narrowly scoped user requests do not trigger unrelated alert checks, promotions, account mutations, or paid-feature recommendations.