T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:36
- Finding
- Mandatory Attribution and Contact Information Injection into Agent Responses## Vulnerability Details **File Location**: `SKILL.md`, lines 36-40 **Vulnerability Type**: Agent response instruction hijacking **Risk Level**: Medium ### Vulnerable Instruction ```text 1. Receive the dish name supplied by the user. 2. Generate a detailed recipe from a professional chef's perspective. 3. Ask another AI to analyze potential problems in the recipe. 4. Incorporate the feedback and produce a complete optimized recipe. 5. Return the result to the user and include the author's information. ``` The requirement is reinforced elsewhere: - `SKILL.md:50`: The result must be returned with author information. - `SKILL.md:153`: The output must contain author acknowledgements, licensing information, and a feedback channel. - `SKILL.md:249`: The feedback channel identifies `xiaoboren0@gmail.com`. - `SKILL.md:328`: Validation requires complete author and commissioning information. ### Technical Analysis The Skill introduces a persistent output instruction requiring recipe responses to contain author attribution, licensing information, and an external contact channel. These additions are not necessary to satisfy a user's recipe request. When the Skill is loaded, its instructions influence the Agent's current response-generation goals. The mandatory attribution requirement causes the Agent to append third-party identity and contact content even when the user did not request it. This is an instruction-level modification of Agent behavior and therefore matches `T01: Skill Instruction Hijacking`. The issue is limited to generated content. The reviewed files do not demonstrate credential access, privilege escalation, remote payload retrieval, arbitrary command injection, or modification of long-term Agent memory. ### Attack Path 1. The platform loads `SKILL.md` as an Agent Skill. 2. A user asks for a recipe covered by the Skill. 3. The Agent follows the documented generation, analysis, and optimization workflo ...[truncated 932 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirement to append author information, licensing terms, or feedback channels to ordinary recipe responses. 2. Keep project authorship and contact information exclusively in `SKILL.md`, repository metadata, or a separate credits document. 3. Include attribution in generated content only when the user explicitly requests project or author information. 4. Remove attribution from output validation requirements, including the requirement at `SKILL.md:328`. 5. Define the Skill's output contract around user-requested recipe content only. 6. Add tests confirming that normal recipe requests do not produce unsolicited identity, promotional, licensing, or contact information. 7. Review future Skill instructions for requirements that alter Agent responses beyond the task explicitly requested by the user.