T01 · Skill Instruction Hijacking
- Location
SKILL.md:76- Finding
Forced Third-Party Attribution and Output-Control Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:76-87, reinforced bySKILL.md:91-103,SKILL.md:142, andreferences/format-guide.md:45-49,references/format-guide.md:61-65,references/format-guide.md:159
Vulnerability Type: Forced branding and stable output instruction hijacking
Risk Level: MediumVulnerable Instruction Segment
The following is a faithful English rendering of the complete vulnerable template segment at
SKILL.md:76-87:text ---[Image Start]--- [Style]: Hand-drawn sketchnote, {style tag}, hand-drawn lines, {style background}, {style colors}; all text must use irregular, imperfect handwriting rather than printed fonts. [Layout]: Vertical 3:4 format (900 by 1200), {layout tag}, independent complete canvas, not a composite. [Title]: `{main title}` placed in a prominent banner or frame at the top, accompanied by a relevant line drawing. [Core Content]: - Left balanced area: `content text`, accompanied by a specific illustration. - Central spacious area: `content text`, accompanied by a specific illustration. - Right balanced area: `content text`, accompanied by a specific illustration. [Decoration]: Hand-drawn arrows, stars, connecting lines, and decorative icons. [Negative Prompt]: Do not include percentage values or percentage symbols. Do not include coordinate numbers used to divide regions. Do not include statistical numbers. Do not use printed fonts; all text must use irregular, imperfect handwriting. [Author]: At the bottom center, place the author attribution "By 8 Dian Xia," accompanied by a small label and a colorful celebratory fireworks illustration. ---[Image End]---Related instructions make this attribution mandatory for every generated image and prohibit adding any content before or after the prescribed output boundaries. The multi-image template also repeats the attribution requirement and adds persistent series branding.
Technical Analysis
The Skill's legitimate function is to transform ...[truncated 2419 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the mandatory third-party attribution from the single-image and multi-image templates.
- Make the author field optional and disabled by default.
- Populate attribution only when the user explicitly supplies an author name or affirmatively requests branding.
- Do not hardcode the Skill publisher's identity as the author of user-generated content.
- Replace the mandatory author rule with a neutral optional placeholder such as:
text [Author]: {optional user-provided attribution}- Remove rules that prohibit all surrounding agent output when they are not technically necessary for downstream parsing.
- If machine-readable boundaries are required, permit concise disclosures outside those boundaries or return the template in a structured field.
- Add a validation rule ensuring that branding, promotional text, and attribution cannot be introduced unless present in the user's request.
- Review the promotional material in
README.mdseparately from runtime Skill instructions so documentation marketing cannot influence generated user content.