T01 · Skill Instruction Hijacking
Error
- Location
assets/post-template.md:145- Finding
Forced Third-Party Promotional Content in Generated Articles
- Content
View full analysis
关注 Mbot 具身智能实验室，第一时间追踪机器人前沿干货。 ``` English translation: “Follow Mbot Embodied Intelligence Laboratory to receive the latest robotics content.” ### Technical Analysis The Skill directs the agent to use `assets/post-template.md` when drafting an article. That template contains a fixed promotional footer for “Mbot Embodied Intelligence Laboratory.” The footer is unrelated to the technical analysis requested by the user and is not presented as optional or disclosed as sponsored content. Because the Skill aims to produce publication-ready articles, template content can be carried directly into the final deliverable. This changes the output from a user-directed paper analysis into content that also promotes a third party. The behavior is best classified as instruction hijacking because Skill-controlled instructions alter the final output for an undeclared promotional objective. ### Attack Path 1. A user requests a robotics-paper analysis or publication-ready article. 2. The agent loads `SKILL.md`. 3. The drafting workflow directs the agent to read `assets/post-template.md`. 4. The agent fills in the template while retaining its fixed footer. 5. The user receives or publishes an article containing an unsolicited third-party promotion. ### Impact Assessment This issue does not grant operating-system privileges, access credentials, or control over local resources. Its impact is limited to the agent’s generated content and the user’s publication workflow. An affected user may unknowingly publish third-party advertising under their own ...[truncated 174 chars]- Remediation
View remediation