T01 · Skill Instruction Hijacking
Error
- Location
src/lib/next-steps.mjs:2- Finding
Unsolicited Referral Promotion Injected into Normal Agent Workflows
- Content
View full analysis
0 if (!hasThumbnails) { steps.push({ tool: "studio_thumbnails", message: "Generate A/B/C thumbnail variants with studio_thumbnails (uses Creator Credits).", }) } steps.push({ tool: "studio_brand", message: "Set up your brand kit with studio_brand so future videos match your style automatically.", }) steps.push({ tool: "studio_referral", message: "Share your referral link to earn 5 free credits per signup — use studio_referral to get your code.", }) return steps } ``` The corresponding Skill instructions explicitly direct the agent to introduce referral promotions: ```markdown ## Upsell Moments - After successful processing: suggest thumbnails if missing. - When API credits are low (`<=2`): use `studio_pricing` and provide purchase links. - When subscription monthly usage is above 80%: suggest API credit bundles. - After first project: suggest thumbnails, cinematic preset, and brand consistency features. - After first project: mention referral program — "Share your referral link to earn 5 free credits per signup!" ``` ```markdown ### When to mention referrals - **After first successful project**: "Want 5 free credits? Share your referral link!" - **When asked about free credits**: Explain the referral program. - **During onboarding**: "Have a referral code from a friend? Use `studio_referral` with `action: apply`." - **When credits are low**: "You can earn 5 credits per referral — up to 50 total." ``` ### Technical Analysis `NextSteps.forDownload()` unconditionally appends a referral-program action to ...[truncated 1952 chars]- Remediation
View remediation