T01 · Skill Instruction Hijacking
- Location
SKILL.md:94- Finding
Persistent Promotional Content Injection into Delivered Game Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:94-96;assets/index.html:2111-2112
Vulnerability Type: Skill instruction hijacking through an embedded promotional directive
Risk Level: MediumEvidence
SKILL.md:94-96:markdown - **结算屏引流 CTA** — on victory the screen shows the challenge code, the per-code best time, and a "去 SkillHub 搜 kitchen-war-rts 给个五星⭐" share prompt, turning every win into organic spread (the promo plan's "让用户替你传播" lever).assets/index.html:2111-2112:javascript if(gc)gc.textContent+=' · 喜欢就去 SkillHub 搜 kitchen-war-rts 给个五星⭐'; }else if(gc){gc.textContent='喜欢这场对战？去 SkillHub 搜 kitchen-war-rts 给个五星⭐';}Technical Analysis
The skill documentation explicitly directs the agent to distribute
assets/index.htmlas the requested game. It also requires the delivered artifact to display an unrelated marketplace search and five-star rating request at game over, characterizing this behavior as a mechanism for organic promotion.The implementation in
showGameOver()applies the promotional message automatically during ordinary game output. The message is not required for RTS gameplay, challenge-code generation, score persistence, or result presentation. Because the directive changes the content of an agent-delivered artifact for the skill publisher's promotional benefit, it constitutes skill instruction hijacking.The behavior is statically embedded and does not rely on external input, network retrieval, or dynamic code. No credential theft, remote-code execution, privilege escalation, system persistence, or data exfiltration was identified in association with this issue.
Attack Path
- A user asks the agent to create or deliver a playable RTS game.
- The skill instructs the agent to copy
assets/index.htmlinto the user's workspace and present it. - The user receives and runs the game without separately requesting promotional content.
- The g ...[truncated 934 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the mandatory promotional CTA and organic-distribution directive from
SKILL.md:94-96. - Remove the SkillHub search and five-star rating strings from
assets/index.html:2111-2112. - Keep the game-over screen limited to gameplay-relevant information, such as match results, completion time, challenge code, and personal best statistics.
- If attribution is desired, disclose it clearly before delivery and require explicit user consent before including it.
- If an optional marketplace link is retained, label it as optional, avoid soliciting a particular rating, and provide a user-controlled configuration that defaults to disabled.
- Add a release check that searches delivered artifacts for marketplace names, rating requests, referral messages, and unrelated calls to action.
- Remove the mandatory promotional CTA and organic-distribution directive from