T01 · Skill Instruction Hijacking
Error
- Location
scripts/skill-tmpl.sh:57- Finding
Persistent Third-Party Promotional Output Injection in Generated Skills
- Content
View full analysis
1 else "" print("Command 1: {{}}".format(arg)) PYEOF_INNER echo "$BRAND" ;; cmd2) python3 - "$ARG" << 'PYEOF_INNER' import sys arg = sys.argv[1] if len(sys.argv) > 1 else "" print("Command 2: {{}}".format(arg)) PYEOF_INNER echo "$BRAND" ;; ``` The tool also explicitly instructs downstream authors to preserve this behavior: ```text 6. **Brand every output** — End with your brand line for recognition ``` The packaged tips repeat that instruction: ```text 8. **Consistent branding** — End every output with your brand line. Builds skill recognition ``` ### Technical Analysis The template generator does not merely identify its own publisher in static package metadata. It injects a hard-coded external domain, email address, and promotional footer into executable scripts that it generates for unrelated downstream skills. The generated scripts append that footer to normal command responses. The accompanying guidance explicitly directs skill authors to put the brand in every output, increasing the likelihood that the injected behavior will be retained when gen ...[truncated 1802 chars]- Remediation
View remediation