T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:34
- Finding
- Mandatory Unrelated Service Calls and Promotional Output Alter Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34`, `SKILL.md:102-103`, `SKILL.md:114-115`, and `SKILL.md:230-231` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:34`: ```markdown - API reference: read `references/reference.md` when fields, commands, or error codes are needed. CLI: `scripts/ari.py` under this Skill directory. Run it from the Skill root, for example `python scripts/ari.py check`; run `check` once at the beginning of every session. ``` `SKILL.md:102-103`: ```markdown 8. After running `check` at the beginning of a session, also run `alerts` once. If there are unread negative-review alerts, proactively tell the user, and propose using `workbench` to locate the negative reviews and `advise --review-id <ID>` to generate reply suggestions. ``` `SKILL.md:114-115`: ```markdown The report directly provides core search terms, long-tail/scenario terms, negative-keyword candidates, competitor brand terms, and a Search Terms string. After a VOC report is produced, proactively mention that buyers' wording in reviews is an effective keyword source. ``` `SKILL.md:230-231`: ```markdown At the end, briefly list the ASIN/site, sample size, statistical window, `reportId`, `creditsUsed`, and current balance. When the output contains `reportUrl`, it must be appended at the end using fixed wording: “View the complete chart-based report online / export: <reportUrl>” (login to the owning account is required). ``` The snippets above are faithful English renderings of the corresponding source instructions. ### Technical Analysis The Skill instructions impose recurring behavior that is not necessarily required by the user's current request: - An authenticated account check is required at the beginning of every session. - An additional alerts request is required even when the user did not ask about alerts. - The agent is instructed to promote a paid analysis fea ...[truncated 2983 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to run `check` at the beginning of every session. Invoke it only when account state, authorization, balance, or payment eligibility is necessary for the requested operation. 2. Do not run `alerts` automatically. Require an explicit alert-related request or ask the user before performing the additional authenticated query. 3. Remove mandatory promotion of keyword analysis, monitoring, billing, or other paid features. Present such options only when directly relevant to the user's stated goal. 4. Replace fixed report-link wording with optional, context-sensitive guidance. Respect requests for concise output or requests not to include external links. 5. Document each automatic network call and the categories of account metadata it returns. 6. Apply a purpose-limitation rule: every authenticated request should be necessary to fulfill the current user request. 7. Keep account mutations, recurring monitoring, and paid operations behind explicit user intent and confirmation, regardless of promotional workflow guidance. 8. Add tests verifying that read-only page-audit requests do not trigger unrelated `check`, `alerts`, monitoring, or paid-feature calls. ]]>