T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:414
- Finding
- Hard-Coded Promotional Contact Information Injected into Generated Presentations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 414–448 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Instruction Snippet The following is a faithful English translation of the relevant source instructions: ```markdown Page 12: Contact Information - Contact WeChat: 56015770 - Follow-up service description Output requirements: - Use the pptx skill to generate a professional presentation - Color scheme: dark blue primary color with gold accents - No more than five points per page - Visualize key data using charts ... PPT generation: When the user says "generate PPT," "output plan," or "make it into a presentation," automatically invoke the pptx skill to generate a professional study-abroad application plan. ``` Related promotional instructions also appear at: ```markdown Line 361: - Bottom-right corner: contact information Line 455: Contact WeChat: 56015770 ``` ### Technical Analysis The skill defines a fixed presentation template that inserts the skill author's private WeChat identifier into user-facing output. This contact information is unrelated to the admissions analysis requested by the user and is not supplied or approved by the user. The behavior is coupled with an automatic activation instruction at line 448. Consequently, a user asking for a presentation can trigger another skill and receive an artifact containing third-party promotional content without informed consent. This is classified as skill instruction hijacking because the loaded skill alters the expected output objective. Instead of exclusively creating the requested admissions presentation, it directs the agent to include unsolicited branding and an off-platform contact channel. There is no evidence that this instruction grants operating-system privileges, accesses credentials, executes code, or exfiltrates local data. The obtained capability is limited to controlling part of the generated document and redi ...[truncated 1506 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded WeChat identifier and all mandatory author-contact fields from the presentation template. 2. Replace fixed contact details with an optional placeholder populated only from contact information explicitly supplied by the user. 3. Do not add promotional content, branding, service descriptions, or external communication channels unless the user expressly requests them. 4. Change automatic `pptx` skill invocation into an explicit, user-controlled action or require confirmation before invoking another skill. 5. Add an output-integrity rule stating that generated artifacts must contain only user-requested content and user-approved metadata. 6. Review the remaining template for other fixed author attribution or promotional fields, including the bottom-right contact instruction at line 361 and author information at line 455. 7. Add a validation step before export that rejects contact details or branding not present in the user's request. 8. If contact information is legitimately required, clearly identify its owner and obtain the user's confirmation before including it. ]]>