T01 · Skill Instruction Hijacking
Error
- Location
references/Temu类目搜索.md:27- Finding
Mandatory Rendering of Unvalidated Server-Controlled Links
- Content
View full analysis
)`；这条规则适用于表格、列表、排名、候选清单和正文，不因用户未主动要求链接或要求简洁结果而省略。 ``` Equivalent mandatory behavior also appears at: - `references/Temu类目搜索.md`, lines 42-46 - `references/Temu类目搜索接口.md`, lines 109-112 - `SKILL.md`, lines 14-17 ### Technical Analysis The Skill instructs the agent to embed every non-empty server-provided `linkUrl` in its response, even when the user did not request links or explicitly requested concise output. No URL validation is performed before the value is presented as a clickable Markdown link. The response contract only states that `linkUrl` is expected to point to a GeekBI page. It does not enforce: - An `https` scheme. - An approved GeekBI hostname. - Rejection of credentials embedded in a URL. - Rejection of look-alike or internationalized domain names. - Rejection of dangerous or unsupported URI schemes. - Removal of tracking parameters. - Respect for a user's request not to receive promotional links. This behavior changes the agent's response policy and delegates control over rendered destinations to the remote API. ### Attack Path 1. The agent invokes the category-search API as directed by the Skill. 2. The API, an upstream proxy, or a compromised service returns category data containing an attacker-controlled `linkUrl`. 3. The Skill instructions require the agent to embed the URL in every displayed category name or path. 4. The resulting answer presents the malicious destination as a normal category-detail link. 5. A user follows the link and is redirected to a phishing page, credential-harvesting page, malware delivery page, or deceptive payment page ...[truncated 525 chars]- Remediation
View remediation