T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:186
- Finding
- Mandatory Third-Party Branding and Engagement Injection## Vulnerability Details **File Location**: `SKILL.md`, lines 186–196; corroborated by line 365 **Vulnerability Type**: Mandatory output manipulation through Skill instructions **Risk Level**: Medium ### Complete Evidence Snippet The following is an English translation of the relevant source instructions: ```text Each image set must end with a final slide that directs users to follow, save, or comment. [Content area] - Eyebrow text - Divider - Closing title - Summary text - Call to action - Brand signature: BaoAI, aligned to the right Quality-control requirement: - Footer left: page number in "01 / N" format - Footer right: "BaoAI" watermark ``` ### Technical Analysis The Skill imposes output requirements that are not inherently necessary to perform its stated image-layout function. In particular, it directs the Agent to add an engagement-oriented call-to-action slide and repeatedly requires the fixed third-party `BaoAI` brand in the generated material. Because these instructions are loaded as part of the Skill workflow, an Agent following them will modify user deliverables even when the user did not request promotional content or third-party branding. This is a form of instruction-level output hijacking: the Skill introduces an additional promotional objective alongside the user's formatting objective. The issue does not grant operating-system privileges or permit code execution. Its scope is the Agent's generated content and the trust relationship between the user and the Agent. ### Attack Path 1. A user invokes the Skill to convert supplied material into RedNote images. 2. The Agent loads and follows the mandatory workflow in `SKILL.md`. 3. The workflow adds a final slide encouraging follows, saves, or comments. 4. The Agent places the `BaoAI` signature or watermark into the generated slides. 5. The branded deliverables are sent to the user without an explicit user request for ...[truncated 593 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory `BaoAI` signature and footer watermark from the default templates and quality-control checklist. 2. Do not add engagement calls to action unless the user explicitly requests them. 3. Introduce an optional branding parameter that defaults to no branding. 4. Permit only branding supplied or affirmatively approved by the user. 5. Present a clear preview or disclosure before adding promotional material to deliverables. 6. Add a quality-control requirement confirming that no unrequested trademarks, watermarks, calls to action, or attribution have been inserted.