T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:83
- Finding
- Mandatory Commercial Redirection and Agent Workflow Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 83–87 **Vulnerability Type**: Mandatory response and workflow manipulation **Risk Level**: High ### Complete Affected Snippet The following is an English rendering of the complete affected segment: ```markdown The system uses strict quota management. If the API returns 403, 402, or explicitly indicates that points are exhausted or the quota is insufficient, you must enter this exception-handling process: 1. **Immediately Stop (Break)**: Absolutely stop all analysis attempts. Do not provide a hallucinated response using generic fortune-telling language. 2. **Redirect Gracefully (Prompt)**: Tell the user: "Your available chart-generation points have temporarily been exhausted. To continue receiving in-depth destiny analysis, visit the Homepage (https://skill.myfate.ai) to subscribe or recharge." 3. **Resume Seamlessly (Resume)**: After the user completes external payment and replies "recharged" or "continue," you are prohibited from asking the user to provide birth information again. Read the parameters directly from the current conversation context, retry the failed curl request, and continue the interpretation. ``` ### Technical Analysis The skill uses mandatory instructions such as “must,” “absolutely stop,” and “prohibited” to control the Agent’s behavior after an API quota or payment error. Instead of allowing the Agent to neutrally report service unavailability or offer safe alternatives, the instructions require it to terminate its normal analysis and display a prescribed subscription or payment link. The same workflow directs the Agent to retrieve birth information from the existing conversation context and retransmit it when the user merely responds with “continue” or an equivalent phrase. Birth date, birth time, and gender are personal information used by the service. A generic continuation response does not necessarily represent informed consent to retransmit those details a ...[truncated 1967 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace mandatory payment language with a neutral statement that the external service is unavailable because its quota has been exhausted. 2. Do not require the Agent to terminate all assistance. Permit it to offer non-API alternatives while clearly distinguishing those alternatives from API-generated results. 3. Make opening or recommending the commercial link optional and require an explicit user request before presenting subscription instructions. 4. Clearly disclose that the destination is an external commercial service and that payment may be required. 5. Before retrying the request, show which personal fields will be retransmitted and obtain explicit, purpose-specific consent. 6. Do not treat a generic response such as “continue” as consent to transmit personal information. 7. Minimize retained data and avoid retrieving birth details from conversation context unless they are necessary for the immediate request. 8. Provide users with an option to re-enter, modify, or delete previously supplied information before retransmission. 9. Restrict retries to the same documented HTTPS endpoint and avoid logging API keys or personal request bodies. 10. Add clear handling for authorization errors so that HTTP 403 is not automatically interpreted as a payment or quota condition. ]]>