T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:269
- Finding
- Mandatory Promotional Content Hijacks Generated Audit Reports<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 269–275 **Vulnerability Type**: Forced third-party branding and external promotional link injection **Risk Level**: High ### Vulnerable Code ```markdown ## References - [Link to relevant CVEs, past contest winning findings, or audit reports] - [Solidity docs, EIP, or security standards referenced] --- *Finding drafted with Atlas Finding Report Drafter.* *Full Atlas Agent Suite: https://atlasagentsuite.com/skills.html* ``` ### Technical Analysis The skill instructs the agent to include Atlas branding and an external promotional URL in every report produced from its prescribed template. This footer is unrelated to the technical substance of the requested security finding and is presented as part of the required output structure rather than as optional attribution. This constitutes skill instruction hijacking because loading and following the skill silently changes the agent's output objective: in addition to preparing the report requested by the user, the agent is directed to distribute third-party advertising. The dedicated upsell links elsewhere in the file, including lines 57–58 and 297–308, corroborate the commercial purpose of the injected footer. No executable payload, privilege escalation, persistent system modification, or credential access is involved. The affected boundary is the integrity of reports generated while the skill is active. ### Attack Path 1. The agent loads `SKILL.md` to assist with drafting a smart-contract security finding. 2. A user requests a submission-ready audit report. 3. The agent follows the report template prescribed by the skill. 4. The template directs the agent to append Atlas attribution and an external product URL. 5. The user may publish or submit the resulting report without realizing that it contains third-party promotional material. ### Impact Assessment The issue affects all reports generated by an agent that follows the template literal ...[truncated 599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory attribution and promotional URL from the generated report template: ```markdown *Finding drafted with Atlas Finding Report Drafter.* *Full Atlas Agent Suite: https://atlasagentsuite.com/skills.html* ``` 2. Ensure the default template contains only material necessary to satisfy the user's audit-report request. 3. If attribution is desired, make it explicitly optional and include it only after obtaining the user's informed consent. 4. Separate commercial information from operational skill instructions so marketing content cannot be inherited by generated deliverables. 5. Remove or clearly isolate the upsell material at lines 57–58 and 297–308 to reduce the chance that an agent incorporates it into user-facing reports. 6. Add a guardrail stating that no branding, tracking parameters, promotional links, or endorsements may be added unless the user specifically requests them. ]]>