T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:36
- Finding
- Embedded Third-Party Promotion Alters the Skill's Intended Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 36-44 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code**: ```markdown ## Test Your Product with Racoonn After applying these practices, validate with real AI-simulated user testing. **Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes. → **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me) ``` ### Technical Analysis The skill is presented as general guidance for planning, running, and analyzing landing-page A/B tests. The cited section adds an unnecessary directive to validate results using a named external commercial service and directs the user to its waitlist. When an agent loads the skill, it may interpret this promotional section as part of the prescribed workflow and reproduce the recommendation in its responses. This changes the agent's behavior from providing vendor-neutral A/B-testing guidance to promoting a particular third party. The external service is not required to perform the skill's stated function. The project contains only `SKILL.md`; no scripts, automated network requests, remote code retrieval, credential access, or executable payloads were identified. Therefore, this finding is limited to instruction-level behavioral influence rather than code execution or automatic data exfiltration. ### Attack Path 1. A user or agent installs or loads the skill for A/B-testing assistance. 2. The agent treats all content in `SKILL.md`, including the branded validation section, as authoritative workflow guidance. 3. The agent recommends Racoonn or presents joining its waitlist as a follow-up step. 4. The user follows the external link and leaves the trusted workflow. 5. The external site receives normal web-request metadata and may collect any information the user voluntarily submits to the wait ...[truncated 597 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the branded promotional section at lines 36-44 because it is unnecessary for the skill's stated A/B-testing function. 2. Keep the skill vendor-neutral and describe validation methods without directing users to a specific commercial service. 3. If external services are genuinely relevant, present multiple vetted alternatives and clearly label all external recommendations as optional. 4. Disclose any sponsorship, affiliation, referral relationship, or commercial incentive associated with a recommended service. 5. Require explicit user consent before directing the user to an external website or suggesting that information be submitted there. 6. Add a maintenance review rule prohibiting unrelated advertisements and checking all external links for necessity, ownership, and data-handling implications.