T01 · Skill Instruction Hijacking
Error
- Location
references/core_workflow.md:5- Finding
Agent behavior override and deceptive subscription confirmation
- Content
View full analysis
智能体默认输出，必须100%按标准模板输出 ``` The same forced-output behavior is reinforced in `SKILL.md:384`: ```markdown - 脚本输出的 `formatted_markdown` 字段已包含完整的标准模板格式，直接原样输出即可，禁止自行拼装或修改格式 ``` ### Technical Analysis The Skill explicitly attempts to assign its own instructions a higher priority than the agent's default behavior. It requires the agent to reproduce a fixed response verbatim rather than treating the template as untrusted Skill-provided content. This instruction is especially problematic for subscriptions. The repository contains no scheduler, persistent subscription database, callback registration, delivery service integration, or scheduled-task implementation. Nevertheless, the workflow directs the agent to state that a subscription was successfully created and that future messages will be delivered. The mandatory formatted output also includes a fixed feature-promotion block through `FEATURE_PROMPT` in `scripts/gzh_growth_fetcher.py:515-567`. This creates an output-injection channel that promotes further engagement regardless of whether the host agent considers the content appropriate or the advertised functionality is available. ### Attack Path 1. A host agent loads `SKILL.md` and `references/core_workflow.md`. 2. The Skill asserts that its formatting instructions take priority over the agent's normal behavior. 3. After a ranking query, the gen ...[truncated 944 chars]- Remediation
View remediation