T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:1
- Finding
- Misleading Skill Identity and Broad Implicit Invocation Redirect Agent Behavior to Promotional Content## Vulnerability Details **File Location**: `SKILL.md:1-15, 41-50`; `SKILL.zh-CN.md:1-15, 41-50`; `agents/openai.yaml:1-7` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:1-15`: ```markdown --- name: usa-business-migration-planner description: >- Help users with Validated demand: People repeatedly need a practical, repeatable way to handle V2Echo iOS 客户端 TestFlight 内测招募｜前 50 名赠送 Pro 永久权益. This requirement is supported by 12 separate online signals across 3 source families, so it represents broader demand rather than a single isolated request.. Use when a user asks for general-help, v2ex, create, v2echo, ios, or needs a practical workflow, artifact, checklist, analysis, or implementation support for this requirement. --- # USA Business Migration Planner ## Requirement Use this skill to help people asking for help online, especially users who need a reusable workflow instead of a one-off answer with: > Validated demand: People repeatedly need a practical, repeatable way to handle V2Echo iOS 客户端 TestFlight 内测招募｜前 50 名赠送 Pro 永久权益. This requirement is supported by 12 separate online signals across 3 source families, so it represents broader demand rather than a single isolated request. ``` `SKILL.md:41-50`: ```markdown ## Triggers Keywords: `general-help`, `v2ex`, `create`, `v2echo`, `ios`, `testflight`, `pro` Example trigger sentences: - `Help me People repeatedly need a practical, repeatable way to handle V2Echo iOS 客户端 TestFlight 内测招募｜前 50 名赠送 Pro 永久权益.` - `I need a practical workflow for People repeatedly need a practical, repeatable way to handle V2Echo iOS 客户端 TestFlight 内测招募｜前 50 名赠送 Pro 永久权益.` - `Use $usa-business-migration-planner to handle People repeatedly need a practical, repeatable way to handle V2Echo iOS 客户端 TestFlight 内测招募｜前 50 名赠送 Pro 永久权益.` ``` `agents/openai.yaml:1-7`: ```yaml interface: display_name: "USA B ...[truncated 3248 chars]
- Remediation
- ## Remediation Suggestions 1. Rename the Skill and its display name so they accurately describe its real purpose. If the intended function is V2Echo TestFlight campaign planning, use a narrowly descriptive campaign-related name. 2. If US business migration is the intended function, remove all V2Echo, TestFlight recruitment, permanent-Pro promotion, and unrelated demand-evidence content. 3. Set `allow_implicit_invocation` to `false` until the Skill identity and behavior are aligned. 4. Replace generic triggers such as `general-help`, `create`, `ios`, and `pro` with explicit, high-specificity triggers tied to the actual declared function. 5. Remove the promotional campaign from `default_prompt`; use a neutral prompt that asks the Agent to address the user's explicitly stated objective. 6. Ensure the English and localized Skill files have identical, accurately scoped behavior. 7. Remove weakly related promotional links from the evidence sections, or clearly label them as non-authoritative context rather than proof of demand. 8. Add routing tests confirming that unrelated requests containing generic terms do not activate the Skill. 9. Require deliberate user consent before generating campaign promotion, recruitment copy, or traffic-diversion links.