T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:233
- Finding
- Mandatory Vendor Link Injection into Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:233-235` **Vulnerability Type**: Forced output modification and promotional link injection **Risk Level**: Low ### Complete Vulnerable Instruction ```markdown At the end, briefly list the ASIN/site, sample size, statistical window (`_window.days`), the returned `reportId` and `creditsUsed`, and the current balance. When the output contains `reportUrl`, it must be appended at the end using the fixed wording: “View the complete chart-based report online / Export: <reportUrl>” (login to the account that owns the report is required). ``` This is an English rendering of the complete instruction segment at the cited location. ### Technical Analysis The Skill requires the agent to append vendor-prescribed wording and a vendor-controlled report URL whenever an API response contains `reportUrl`. This is not merely a structured result field: it dictates the content and placement of text in the agent's final response. Because the instruction is automatically loaded as part of the Skill, it modifies how the agent communicates with the user and creates a persistent promotional output pattern within the current session. The link points to the pinned vendor origin, `https://ari.funewa.com`, and the audit found no evidence that the URL is used to retrieve or execute code. Nevertheless, mandatory insertion exceeds the minimum output control needed to organize Amazon review information into product requirements. ### Attack Path 1. A user invokes the Amazon product-requirements Skill. 2. The Skill sends an authenticated request to the ARI service for a report. 3. The service returns a response containing a `reportUrl`. 4. The loaded Skill instruction requires the agent to place that URL at the end of its response. 5. The agent inserts the fixed vendor-provided promotional wording even when the user did not request an online report or export link. 6. The user may follow the link and be redirected from the con ...[truncated 1060 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement that the link and fixed wording must always appear at the end of the response. 2. Return `reportUrl` as an optional structured result field rather than an agent-output directive. 3. Display the URL only when: - the user explicitly requests an online report, export page, chart view, or share link; or - the agent determines that the link is directly relevant and clearly labels it as optional. 4. Replace the fixed promotional sentence with neutral wording, such as: ```markdown Optional online report: <reportUrl> ``` 5. Preserve user formatting preferences, including requests for concise output or responses without external links. 6. Continue validating report URLs against the pinned HTTPS origin before presenting them. 7. Treat all remotely returned display text and URLs as untrusted data and prevent API responses from introducing new agent instructions. ]]>