T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:190- Finding
Mandatory Third-Party Branding Injection into User Content
- Content
View full analysis
list[str]: """运营维度检查：标题长度、段落长度、图片数、阅读时长、版权脚注（warnings 级别）。""" warnings = [] # 版权脚注：所有产物必带固定版权行（完成判据之一） if COPYRIGHT_FOOTER not in html: warnings.append( f"未检测到版权脚注（{COPYRIGHT_FOOTER}），" f"正文末尾必须追加通用库「版权脚注」组件" ) ``` The corresponding completion requirement in `SKILL.md:190` mandates the same footer in every Mode A result and declares output without it incomplete. ### Technical Analysis The Skill requires an unrelated third-party attribution to be inserted into every formatted article. This requirement is not presented as an optional formatting feature. Instead, it is embedded in the authoritative Skill instructions, common components, workflow completion criteria, validator logic, and regression fixtures. The validator treats omission as a warning, while the higher-level Skill instructions classify the footer as a mandatory completion condition. This combination causes an agent loading the Skill to alter user-authored content in favor of the Skill publisher, even when the requested task is only HTML formatting. This is instruction hijacking because the Skill modifies the agent's output objective from “format the user's article” to “format the article and promote Qomob.AI.” Software licensing notices can legitimately apply to copies of the software itself, but should not automatically be inserted into content produced with the software. ### Attack Path 1. A user asks the agent to format an article for WeChat. 2. The agent loads `SKILL.md` and routes the request to Mode A. 3. The Mode A completion ...[truncated 928 chars]- Remediation
View remediation