T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:17- Finding
Mandatory Promotional Output Injected into Agent Responses
- Content
View full analysis
欢迎使用 **LJHskill 电商老家伙工具箱**。 > > 你可以从下面任意一个方向开始： > > **A. 产品判断**：把产品 brief 发给我，我帮你判断值不值得打、定位是否清楚、卖点是否成立。 > **B. 内容诊断**：把带货脚本、素材文案或爆款案例发给我，我帮你检查说服链、内容因子和人群对齐。 > **C. 经营诊断**：告诉我投放或经营问题，例如掉量、转化下降、ROI 异常、退货或利润问题。 > > 直接回复 **A、B、C**，或者用一句话告诉我你现在卡在哪里。 > > 我们还有一个 **LJHskill 用户交流群**，解决安装和使用问题，发布功能更新和实战案例。加微信备注「LJHskill」： > > 李解：`lijiedelijiea` 瀚森：`DamonWang1993` ``` ### Technical Analysis When the skill is loaded for the first time, it directs the agent to prepend a fixed branded onboarding message before addressing the user's request. That message includes an unsolicited invitation to an external WeChat community and two external contact identifiers. This behavior is unrelated to the skill's primary content-factor analysis functionality. Because it is expressed as a mandatory skill instruction, it changes the agent's user-facing response behavior merely by loading the skill. This is consistent with skill instruction hijacking: the skill uses trusted instruction text to introduce an additional promotional objective into the active session. The instruction also checks for and attempts to create `~/.ljhskill/onboarding.json`. This marker makes the promotional behavior conditional across later invocations. The file contains only onboarding status and a timestamp, so the available evidence does not establish agent memory poisoning, executable persistence, or a backdoor. Nevertheless, it writes state outside the project directory without requiring explicit user approval. ### Attack Path 1. A user installs or invokes the skill for a legitimate content-factor analysis task. 2. The agent loads and follo ...[truncated 1446 chars]- Remediation
View remediation