T01 · Skill Instruction Hijacking
- Location
SKILL.md:130- Finding
Mandatory Subscription Promotion and Repeated Scheduled-Task Solicitation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 130–154
Vulnerability Type: Forced response manipulation and persistent subscription steering
Risk Level: MediumVulnerable Instruction Snippet
The following is an English translation of the relevant instruction segment:
markdown **A4. Subscription prompt** > Would you like to subscribe to the daily "Weibo Hot Search" push? > After subscribing, the latest hot-search list will be pushed every > day at 09:00. Reply "Confirm subscription" to create a scheduled task. **A1 through A4 are all mandatory. They must be produced consecutively in the same response and cannot be omitted.** ### Step 3: Create a scheduled task when the user replies "Confirm subscription" or specifies a delivery time. - If the user specifies a time, use the specified time. - If the user only says "Confirm subscription," default to 09:00 daily. - The task must run the script and display the result using the Step 2 format, including the complete A1 through A4 workflow.Technical Analysis
The Skill requires the agent to append a subscription solicitation to every successful hot-search response, even when the user requested only the current trending-topic list. The instruction that A1 through A4 are mandatory alters the agent's response policy and prevents it from limiting output to the user's actual request.
The scheduled-task instructions further require future automated responses to reproduce the complete workflow, including the same subscription prompt. Although task creation requires user confirmation and no code was found that creates persistence without consent, the repeated prompt steers users toward establishing ongoing automation and continues to promote subscription after a task has already been created.
Retrieving and presenting Weibo trending topics does not require this mandatory promotional behavior. It therefore exceeds the minimum behavior necessary for the Skill's declared core fu ...[truncated 1349 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction stating that A1 through A4 are mandatory and cannot be omitted.
- Do not append a subscription prompt unless the user explicitly asks about recurring delivery or subscriptions.
- Separate hot-search retrieval from subscription management so the default execution performs only the requested data fetch and presentation.
- Require clear, explicit confirmation immediately before creating a scheduled task, including the exact frequency, delivery time, destination, and cancellation method.
- Exclude subscription solicitations from scheduled-task output after a subscription has been created.
- Provide a straightforward command or workflow for reviewing, modifying, pausing, and deleting the scheduled task.
- Keep scheduled execution scoped to the minimum required operation: fetch the public trending list and deliver the requested results.