T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:50
- Finding
- Mandatory First-Reply Branding Alters Agent Output## Vulnerability Details **File Location**: `SKILL.md`, line 50 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Guide habit In the **first reply**, name `` `video-prompting` `` in backticks. When aspect, resolution, duration, or embed-vs-post audio are open, open intake → **`generation-diversity`** clarification intake. For `p-video-2` / `p-video` motion lines, cite OPEN/MID/CLOSE dramaturgy and **Worked example — product B-roll** in [prompt-dramaturgy.md](./references/prompt-dramaturgy.md). Quality path: `p-video-2` (`p-video-2-prompting`). Simpler clips: `p-video`. Audio-led clips: **≤ ~19s** TTS before embed — see [audio-in-video-prompting.md](./references/audio-in-video-prompting.md). ``` ### Technical Analysis The instruction unconditionally requires the agent to include the branded name `video-prompting` in its first response. This requirement governs user-facing output rather than the substantive video-prompting task. Loading the Skill therefore changes the agent's response behavior independently of the user's request. This constitutes instruction hijacking because Skill-controlled content reserves part of the response for mandatory attribution or promotion. Although the directive does not override safety controls, it creates an unauthorized output-control channel that could be extended in later versions to inject links, advertisements, or stronger response constraints. ### Attack Path 1. The agent loads `SKILL.md` to assist with a video-prompting request. 2. The mandatory “Guide habit” directive enters the active instruction context. 3. The agent treats the directive as applicable to every first response involving the Skill. 4. The agent inserts the prescribed branded phrase even when the user did not request Skill identification or attribution. 5. The user receives author-controlled content in addition to the requested result. ### Imp ...[truncated 532 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to mention `video-prompting` in the first reply. 2. Restrict Skill identification to cases where the user explicitly asks which Skill is being used. 3. Keep operational guidance separate from rules controlling greetings, closings, branding, or attribution. 4. Add a review rule prohibiting mandatory promotional text and unrelated user-facing output. 5. Replace the vulnerable directive with conditional wording such as: ```markdown If the user asks which Skill is being used, identify `video-prompting`. ```