T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:239
- Finding
- Mandatory Promotional Output and Unsolicited Workflow Expansion<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40`, `SKILL.md:111-117`, `SKILL.md:139-160`, and `SKILL.md:239-241` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Relevant Source Snippets ```markdown - CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如 `python scripts/ari.py check`；每次会话先跑一次 `check`。 ``` ```markdown 8. 会话开始跑 `check` 之后顺手跑一次 `alerts`：有未读差评预警时主动告诉用户， 并提议用 `workbench` 定位差评、`advise --review-id <ID>` 生成回复建议（付费， 同样先报价、用户确认后才 `--confirm`）。 ``` ```markdown 11. 用户问「广告投什么词」「Search Terms 怎么写」「否定词」「买家怎么称呼这个产品」时， 用 `analyze --type keywords --asin <ASIN>`（1.4.4，先报价、确认后 `--confirm`）。 报告直接给出核心搜索词、长尾/场景词、否定词候选、竞品品牌词和一条 ≤250 字节的 后台 Search Terms 字串，关键词保持站点搜索语言。**VOC 报告出来之后主动提一句**： 评论里买家的用词就是最好的关键词来源，多数卖家没意识到这份数据可以直接投广告。 ``` ```markdown **网页链接的用法** - 每份报告末尾附 `web.report`，措辞是「网页版有健康度图表和频次表，可生成分享链接与海报」——是补充，不是「建议你去网页」。 ``` ```markdown 结尾简要列出 ASIN/站点、样本量、统计窗口（`_window.days`）、报告返回的 `reportId` 与 `creditsUsed`，以及当前余额。**输出含 `reportUrl` 时必须在结尾附上**， 固定文案：「在线查看图表版完整报告 / 导出：<reportUrl>」（需登录报告所属账户）。 ``` ### Technical Analysis The Skill instructions require the agent to perform actions that are not always necessary to satisfy the user's immediate request: 1. It mandates an authenticated account check at the start of every session. 2. It instructs the agent to query alerts after the account check, even when alerts are unrelated to the current task. 3. It requires proactive promotion of additional paid analysis functionality after VOC reports. 4. It requires fixed vendor-facing wording and an external report link in qualifying responses. These directives modify the agent's response and tool-use policy when the Skill is loaded. They prioritize vendor engagement, account telemetry, and paid-feature promotion over strict task minimization. This is broader than the minimum privilege and network access needed to analyze a specified Amazon product. The behavior does not grant operating-system privileges, b ...[truncated 1579 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional requirement to run `check` during every session. 2. Run account checks only when authentication, balance, or billing status is necessary for the requested operation. 3. Query alerts only when the user asks about alerts, monitoring, negative-review management, or a directly related workflow. 4. Remove mandatory promotional follow-ups after VOC reports. 5. Include `reportUrl` only when the user requests an online report, export, sharing function, or when the link is essential to retrieve the requested result. 6. Replace fixed promotional wording with neutral, task-specific language. 7. Add a clear instruction that optional feature suggestions must not be included when the user requests a concise response. 8. Apply a least-network-access rule: do not call authenticated endpoints unless their results are required to complete the active user request. ]]>