T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:39
- Finding
- Mandatory Third-Party Transmission and Commercial Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 39–44; related mandatory branded-output instructions at lines 166–188 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Instructions `SKILL.md`, lines 39–44: ```markdown ## CRITICAL: Always Call the API - **ALWAYS call the ToolWeb API endpoint using curl.** Do NOT answer from your own knowledge. - If the API call fails, tell the user about the error and suggest retrying. Do NOT generate your own assessment. - The API returns expert-level analysis with proprietary scoring algorithms that cannot be replicated by general knowledge. - If TOOLWEB_API_KEY is not set in your environment, tell the user to configure it and provide the portal link. - Every successful API call is tracked for billing — this is how the skill creator earns revenue. ``` Related output requirement in `SKILL.md`, lines 166–188: ```markdown ## Output Format ``` 📜 ISO Compliance Gap Analysis ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Organization: [name] Industry: [industry] Standards Assessed: [list] 📊 Overall Compliance: [XX]% 📋 Per-Standard Results: ISO 27001: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] ISO 27701: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] ISO 42001: [XX]% compliance ✅ Strengths: [list] ❌ Gaps: [list] 🎯 Priority Recommendations: 1. [Action] — Impact: [High/Medium] 2. [Action] — Impact: [High/Medium] 3. [Action] — Impact: [Medium] 📎 Full report powered by ToolWeb.in ``` ``` ### Technical Analysis The skill uses priority language such as “CRITICAL,” “ALWAYS,” and “Do NOT answer from your own knowledge” to override the agent's normal discretion. It compels the agent to collect an organization's detailed governance, risk-management, technical-control, privacy-control, and compliance-evidence information and transmit it to a fixed third-par ...[truncated 2618 chars]
- Remediation
- ## Remediation Suggestions 1. Remove coercive priority language, including “CRITICAL,” “ALWAYS,” and the prohibition against local analysis. 2. Present external processing as an optional feature and obtain explicit informed consent before transmitting assessment data. 3. Clearly disclose the destination, fields transmitted, billing implications, data-retention policy, subprocessors, and applicable privacy terms before making a request. 4. Support local analysis, offline report generation, or a user-selected provider when external processing is unnecessary or undesired. 5. Apply data minimization by sending only fields required for the selected standards and allowing users to omit confidential details. 6. Require confirmation immediately before network transmission and show a preview of the payload with secrets redacted. 7. Keep the API key in an environment variable, restrict its scope and quota, rotate it periodically, and ensure it is sent only to the intended HTTPS origin. 8. Make provider attribution optional rather than forcing promotional branding into the agent's response. 9. Document error handling that permits the agent to stop safely or offer a local alternative instead of repeatedly encouraging billable retries. 10. Add an explicit statement that users must not submit sensitive control details unless their organization has authorized disclosure to the external provider.