T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:60
- Finding
- Downstream Moderation Avoidance Instruction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Vulnerable Snippet ```python "brief_text": "...", # in ENGLISH — avoids Gemini moderation filters in Spanish ``` The snippet above is an English translation of the source directive while preserving its complete security-relevant meaning. ### Technical Analysis The Skill explicitly instructs the agent to formulate downstream prompts in English to avoid moderation filters triggered by Spanish wording. This does not merely recommend clearer prompts; it identifies a language-dependent moderation behavior and directs the agent to circumvent it. When loaded, the Skill alters the agent's execution constraints by treating successful filter avoidance as part of the required workflow. This is instruction hijacking because the Skill attempts to weaken safeguards imposed by a downstream AI service. ### Attack Path 1. An agent loads `SKILL.md` and follows the Morpheus image-generation workflow. 2. The agent prepares the `brief_text` input for the downstream service. 3. Instead of selecting language based on ordinary task requirements, the agent uses English specifically to avoid moderation behavior encountered in Spanish. 4. The modified prompt is submitted to Gemini or the associated deployment. 5. Content that might otherwise be reviewed or rejected can reach the generation pipeline. 6. Generated assets can subsequently be processed by Multishot, VEED, ffmpeg, and Postiz. ### Impact Assessment This instruction may enable bypass of language-sensitive safety controls in a downstream model. The resulting scope is limited to content generated through the described pipeline; no evidence shows that it grants operating-system privileges, account escalation, credential access, or arbitrary code execution. The principal impact is reduced effectiveness of downstream content moderation and an increased possi ...[truncated 75 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all instructions that recommend changing language for the purpose of avoiding moderation. - Require prompts to comply with downstream safety policies regardless of the language used. - Select prompt language solely according to user needs, model capability, and output quality. - Treat moderation failures as a signal to revise potentially unsafe content rather than as a filter to circumvent. - Add an explicit policy stating that the pipeline must not evade, weaken, or work around safeguards imposed by Gemini or any other external service. - Log downstream moderation failures and route repeated failures for human review. ]]>