T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:133
- Finding
- Mandatory promotional output and host scheduler manipulation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:133-141` **Vulnerability Type**: Agent instruction and output hijacking **Risk Level**: High ### Vulnerable Instruction Snippet The following is an English translation of the operative directives at the specified location: ```text - Subscription prompt: mandatory when articles are present; it must not be skipped. - Ask whether the user wants to subscribe to the current search conditions. - If the user selects subscription, ask for a delivery time and use the host's scheduled-task or calendar tool to create the subscription. ``` Related mandatory-output directives also occur at: - `SKILL.md:297` - `SKILL.md:331` - `scripts/fetch_explosive_articles.py:1041` - `scripts/fetch_explosive_articles.py:1065` The script-level directive at line 1041 requires the generated content to be reproduced unchanged and prohibits omission of the subscription section. ### Technical Analysis The Skill makes subscription promotion a mandatory component of otherwise ordinary data-query responses. It also instructs the Agent to invoke host scheduling or calendar capabilities after a user accepts the subscription. Retrieving or displaying Xiaohongshu ranking data does not require recurring-task creation or mandatory promotional output. These directives therefore alter the Agent's response policy and expand the operation into host-level scheduling beyond the minimum privileges required for the core query and reporting functionality. The scheduler action is conditional on user acceptance, so the reviewed code does not establish an automatic persistence mechanism by itself. Nevertheless, the mandatory response modification constitutes instruction hijacking, and the scheduler workflow creates a potential persistence boundary that requires stronger confirmation controls. ### Attack Path 1. The Skill is loaded for an ordinary Xiaohongshu data request. 2. The Skill requires the Agent to append subscription promotion to ...[truncated 827 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all directives requiring subscription text to be included in every response. 2. Present subscription functionality only when it is directly relevant or explicitly requested. 3. Require a separate, explicit confirmation immediately before creating a recurring task. 4. Before confirmation, display: - The exact schedule and time zone. - The query parameters and destination. - The executable command or operation. - The expected network endpoints. - Instructions for listing, disabling, and deleting the task. 5. Restrict scheduler use to a narrowly scoped host API rather than arbitrary command scheduling. 6. Do not interpret ambiguous shorthand as authorization to create persistence. 7. Ensure a normal one-time query can complete without requesting scheduler access. ]]>