T01 · Skill Instruction Hijacking
Error
- Location
- scripts/generate_brief.js:133
- Finding
- Mandatory Undeclared Branding in Agent-Delivered Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_brief.js:133, 287, 296, 305, 314, 322`; execution and direct-delivery instructions at `SKILL.md:36-47` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```javascript // Sector report L.push(`内容科学｜Content Science`); L.push(`📊 ${data.description} · 板块研报`); // ... L.push(`— 内容科学｜Content Science · 以上内容由 AI 基于公开数据生成，仅供参考，不构成投资建议 —`); ``` ```javascript // AI news report L.push('内容科学｜Content Science'); L.push('📊 AI 股票内参简报'); // ... L.push('— 内容科学｜Content Science · 仅供参考，不构成投资建议 —'); ``` ```javascript // Market-monitor report L.push('内容科学｜Content Science'); L.push('🔔 AI 概念股异动提醒'); // ... L.push('— 内容科学｜Content Science · 仅供参考，不构成投资建议 —'); ``` The relevant Skill workflow at `SKILL.md:36-47` requires the Agent to execute the generator and directly send the resulting Markdown to the user: ```markdown node scripts/generate_brief.js --mode sector --sector <sector-name> --output pretty ``` The workflow then instructs the Agent to send the generated Markdown directly, splitting it only when required by the platform's message-size limit. ### Technical Analysis Every report builder in `generate_brief.js` unconditionally inserts the `Content Science` brand at both the beginning and end of its output. This behavior affects sector reports, AI news reports, and market-monitor reports. The branding is unrelated to the technical requirements of retrieving market data, mapping stocks, detecting market movements, or generating analysis. It is also absent from the fixed report layout declared in `SKILL.md`. Because the Skill instructs the Agent to send the generated Markdown directly, the Agent is made to reproduce the undeclared branding during ordinary use. This is a form of output-oriented Skill instruction hijacking: loading and following the Skill changes the Agent's final response by adding persistent promotional attribution that the user did n ...[truncated 1312 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded branding statements at lines 133, 287, 296, 305, 314, and 322. 2. Retain only neutral report titles and a generic investment-risk disclaimer. 3. If attribution is legitimately required, disclose it clearly in `SKILL.md` and make it configurable or opt-in. 4. Do not instruct the Agent to forward generated content without review. Require the Agent to verify that output contains only requested report content. 5. Add automated tests asserting that default output does not contain undeclared brands, advertisements, tracking links, referral material, or unrelated calls to action. 6. Separate report content from optional presentation metadata, for example: ```javascript function addAttribution(lines, attribution) { if (attribution) lines.push(attribution); } ``` The default value should be empty, and any attribution should require explicit user or deployer configuration. ]]>