T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:451- Finding
Skill Instructions Attempt to Override the Agent's Response Behavior
- Content
View full analysis
⛔ **强制输出规则**:日报生成后,对话回复**必须严格按照下方「📊 输出格式」模板输出 md 内容**,禁止任何自由发挥、省略、简化或口语化文字。模板是唯一合法输出格式。 ## 📊 输出格式(强制执行) > ⛔ **严格执行规则**: > - 以下模板是**唯一合法输出格式**,禁止任何自由发挥、省略、简化或重新组织 > - 禁止输出模板中未定义的额外内容(如"我来帮你…""以下是…"等口语化文字) > - 禁止合并、跳过任何板块,即使某板块数据为"暂无"也必须保留该板块标题 > - **每次获取日报后,对话回复必须严格按此模板输出 md 内容,不得包含模板以外的任何文字** 每次运行日报后,对话输出**必须严格**按以下模板原样输出(仅替换 `{...}` 占位符): ``` The directives state that the supplied template is the “only legal output format,” prohibit any text outside it, and prevent the agent from reorganizing, omitting, or supplementing its response. ### Technical Analysis Skill documentation is treated as operational input to the agent. A Skill may legitimately recommend a report format, but it should not claim authority over all agent responses or prohibit safety notices, error explanations, higher-priority instructions, and user-requested output changes. The affected instructions repeatedly require strict compliance and characterize the Skill-defined format as the only permissible response. This exceeds the formatting needs of the declared reporting functionality and attempts to alter the agent's behavior for the current session. The same directive is repeated in both `SKILL.md` and `references/core_workflow.md`, increasing the likelihood that an agent loading either document will treat it as mandatory. ### Attack Path 1. The agent loads `SKILL.md` while handling a Xiaohongshu short-drama request. 2. The Skill instructs the agent to treat its report template as the only legal response format. 3. The report-generation workflow runs or encounters an error, warning, or safety-relevant condition. 4. The Skill directive prevents the agent from including information outside the suppli ...[truncated 816 chars]- Remediation
View remediation