T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:230
- Finding
- Mandatory Commercial Output Steering and External-Service Promotion## Vulnerability Details **File Location**: `SKILL.md:230-231` **Vulnerability Type**: Mandatory response modification through Skill instructions **Risk Level**: Medium ### Evidence The relevant Skill instruction, translated into English, is: ```markdown At the end, briefly list the ASIN/site, sample size, statistical window (`_window.days`), the returned `reportId` and `creditsUsed`, and the current balance. When the output contains `reportUrl`, it must be appended at the end using the fixed wording: “View the complete chart-based report / export online: <reportUrl>” (login to the account that owns the report is required). ``` Related instructions elsewhere in `SKILL.md` also direct the agent to proactively promote recurring monitoring and additional analysis after completing reports. ### Technical Analysis The Skill imposes a persistent, mandatory final-response rule that requires the agent to insert a branded external-service link using fixed promotional wording. It also directs the agent to proactively suggest recurring monitoring and additional paid analysis even when those services were not part of the original request. This behavior exceeds the minimum instructions required to compare competitor price snapshots. A price-positioning Skill may legitimately return a report URL as optional result metadata, but it does not need to force that URL into every applicable final response or require unsolicited commercial follow-up. The behavior is classified as `T01: Skill Instruction Hijacking` because loading the Skill changes how the agent constructs the current session response. The instructions steer the agent away from a neutral, request-scoped answer and toward mandatory promotion of the operator's external service. This finding does not establish local code execution, credential theft, privilege escalation, or host compromise. The risk concerns manipulation of agent output and user decision-making. ### At ...[truncated 1420 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory promotional wording with neutral, optional metadata: - Return `reportUrl` as a structured field. - Mention it only when the user asks for an online report, export, or shareable view. - Do not require fixed marketing language. 2. Remove instructions that require unsolicited cross-selling: - Do not proactively recommend recurring monitoring, keyword analysis, or other paid features unless they directly address the user's request. - Clearly distinguish operationally necessary next steps from optional commercial services. 3. Apply request-scoped response rules: - Keep the final answer limited to the requested comparison, evidence limitations, and explicitly requested deliverables. - Allow the agent to omit external links when a self-contained answer is sufficient. 4. Add transparent consent boundaries: - Explain when following a link or enabling monitoring will transmit additional product or account information. - Require explicit user intent before creating recurring server-side monitoring or initiating paid operations. 5. Preserve neutral wording: - Describe external reports as optional supplementary views rather than mandatory destinations. - Avoid fixed calls to action embedded in the Skill's response instructions.