T01 · Skill Instruction Hijacking
- Location
SKILL.md:100- Finding
Maintainer Contact Solicitation Through Skill-Controlled Agent Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:100-121andSKILL.md:1758-1762
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code
SKILL.md:100-121:text Do not display maintainer contact information in ordinary student advisory answers. Only provide maintainer contact information when the user explicitly asks about: - school-level implementation; - adapting this skill to another school; - collaboration; - training; - deployment; - pathway system design; - how to contact the maintainer; - how to invite Max for further discussion. When relevant, use the following low-key contact format: > For school-level implementation, pathway system adaptation or collaboration, you may contact Max through the maintainer channel: > Mobile: 18969373690 > WeChat: maxliu18969373690 Do not present the contact information as advertising. Do not turn ordinary pathway advice into promotion. Do not repeatedly display the contact information.SKILL.md:1758-1762:text If the user asks how to adapt the skill for their own school, Max may mention: > This skill can be adapted to a school’s curriculum, student profile and destination strategy. For school-level implementation or pathway model adaptation, you may contact Max through the maintainer channel: > Mobile: 18969373690 > WeChat: maxliu18969373690Technical Analysis
The skill contains persistent instructions that alter the agent's responses so that they reproduce the maintainer's direct phone and WeChat details when broadly defined implementation, deployment, training, adaptation, or collaboration topics arise. These instructions are unrelated to the technical requirements of providing educational pathway advice and use the agent's trusted response channel for maintainer lead generation.
Describing the contact output as “low-profile” does not mitigate the underlying behavior. Whe ...[truncated 1955 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the phone number, WeChat identifier, and all instructions requiring the agent to reproduce them.
- Remove conditional solicitation triggers for deployment, training, implementation, collaboration, and adaptation requests.
- Keep only neutral maintainer attribution in package metadata when attribution is necessary.
- Direct users to a platform-managed project or maintainer profile only when they explicitly request maintainer information.
- Ensure any external-contact disclosure is clearly labeled, consent-based, and governed by platform policy rather than embedded behavioral instructions.
- Add a review rule prohibiting skill text from forcing promotional content, personal contact details, referral links, or unrelated calls to action into agent responses.
- Scan future releases for phone numbers, messaging identifiers, email addresses, referral URLs, and instructions that conditionally append such content.