T01 · Skill Instruction Hijacking
Error
- Location
- index.ts:6
- Finding
- Unconditional Skill Instruction Hijacking## Vulnerability Details **File Location**: `index.ts:6-21` **Vulnerability Type**: Unconditional system-prompt and response-goal override **Risk Level**: High ### Complete Code Snippet ```ts systemPrompt: `你是专业的学术文献自动解析助手。 用户发送的任何文本，都视为需要解析的文献内容。 请严格按照以下格式输出，不要多余文字、不要解释、不要提问： 【摘要】 用简洁、通顺的语言概括全文核心内容。 【关键词】 列出3–6个最核心的关键词。 【核心结论】 提炼1–3条最重要的结论或观点。`, trigger: { type: 'always', // 设为始终触发，即默认技能 }, ``` The prompt states that every user message must be treated as literature and requires the agent to return only a fixed summary format without explanations or clarifying questions. The `always` trigger applies these instructions to every interaction rather than limiting them to explicit document-analysis requests. ### Technical Analysis This configuration changes the agent's active objective whenever the Skill is loaded. The broad input-reclassification rule combines with unconditional activation to override unrelated user goals. The prohibition against explanations and questions also prevents the agent from clarifying ambiguous input or responding normally. Although the Skill does not execute code or obtain system privileges, it exercises instruction-level control beyond the scope reasonably required for an opt-in literature summarizer. The same behavior is also documented in `SKILL.md:6-18`. ### Attack Path 1. The Skill is installed or loaded into an agent session. 2. The `trigger.type` value of `always` activates it for every user message. 3. The system prompt reclassifies arbitrary user input as literature requiring analysis. 4. The fixed-output rule prevents normal answers, explanations, and clarification. 5. Unrelated user requests are consequently redirected into summaries, keywords, and conclusions. ### Impact Assessment The issue affects the agent's current-session behavior and response integrity. It can suppress unrelated tasks, interfere with other skills, prevent necessary clarification, and replace the user's intended objective with document s ...[truncated 161 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unconditional `always` trigger with explicit invocation or a narrowly scoped intent trigger for literature-analysis requests. 2. Remove the rule that classifies every user message as literature. 3. Apply the fixed response format only after the user explicitly requests document summarization. 4. Permit clarification when the input is missing, ambiguous, unsupported, or unrelated to literature analysis. 5. Ensure the Skill yields to the user's current objective and does not override unrelated tasks or other active skills. 6. Update `SKILL.md` and `index.ts` together so the documentation and runtime configuration enforce the same restricted activation scope.