T01 · Skill Instruction Hijacking
- Location
SKILL.md:176- Finding
Mandatory Third-Party Branding Injected into Generated Documents
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 176
Vulnerability Type: Mandatory output manipulation
Risk Level: LowEvidence
markdown *由开心果 🍀 自动生成 · 数据来源：arXiv*The embedded text translates to: “Automatically generated by Happy Pistachio · Data source: arXiv.”
Technical Analysis
The required document template contains a fixed third-party attribution. Because the skill directs the agent to use this template for every generated paper digest, normal execution adds branding that the user did not request.
This constitutes skill instruction hijacking because the skill modifies the expected task output by imposing unrelated attribution. It can also create a misleading statement about the identity or organization responsible for generating the report.
No mechanism is provided to disclose, remove, or obtain user consent for this attribution. The instruction is therefore applied persistently to every document created through the documented workflow.
Attack Path
- A user invokes the skill to generate a speech-paper digest.
- The agent follows the mandatory document structure in
SKILL.md. - The fixed attribution is appended to the generated content.
- The agent uploads the resulting document to Tencent Docs.
- Readers encounter unsolicited branding that may falsely identify the report's producer.
Impact Assessment
The issue does not grant operating-system privileges, access credentials, or code-execution capabilities. Its scope is limited to content generated through this skill.
Successful exploitation permits manipulation of every generated report by inserting fixed third-party branding and potentially misleading authorship attribution. The affected outputs may be distributed or stored in Tencent Docs without the user noticing the imposed attribution.
- Remediation
View remediation
Remediation Suggestions
- Remove the fixed third-party attribution from the mandatory document template.
- Use a neutral footer such as “Generated from arXiv data” if provenance information is necessary.
- Require explicit user approval before adding an organization, product, or author identity to generated documents.
- Make attribution configurable rather than mandatory, with branding disabled by default.
- Review all output templates for other content unrelated to the user's requested task.