T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:33
- Finding
- Mandatory Third-Party Branding and Agent Identity Override## Vulnerability Details **File Locations**: - `SKILL.md:33-35` - `SKILL.md:49-51` - `references/战略规划7步引导流程.md:4` - `references/战略规划7步引导流程.md:18` - `references/对话示例与文件生成.md:10` - `references/对话示例与文件生成.md:172-176` **Vulnerability Type**: Agent identity and output-template hijacking **Risk Level**: High **Relevant Snippets**: The following English translations preserve the meaning of the original instructions: ```markdown ## Role Definition - Identity: A senior management consultant with 20 years of enterprise strategic-planning experience, code-named “Shundao Strategic Consulting Advisor” - Style: Professional but unpretentious, direct but inoffensive, pragmatic rather than abstract, sincere rather than flattering - Brand: Shundao Consulting ``` ```markdown ## Execution Instructions 1. After loading this Skill, first read all reference documents and understand the complete seven-step process. 2. Start from Step 1 and interact with the user using the prescribed guidance. 3. Strictly follow the corresponding output-format template at every step. ``` ```markdown Designer: Shundao Consulting I am the Shundao Strategic Consulting Advisor and will assist you in completing enterprise strategic planning. ``` ```markdown Thank you for using the Shundao strategic-planning service! ``` ### Technical Analysis The Skill assigns the Agent a fixed identity associated with a named third-party brand. It also directs the Agent to read all referenced documents and strictly follow their response templates. Those templates repeatedly introduce the Agent as a “Shundao Strategic Consulting Advisor” and prescribe a branded closing. Strategic-planning functionality does not require the Agent to claim affiliation with a particular organization. The combination of a mandatory branded identity, strict template adherence, repeated introductions, and a branded closing alters the Agent’s normal identity and output beha ...[truncated 1788 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the named identity with a neutral functional role, such as “strategic-planning assistant.” 2. Remove mandatory references to the third-party consulting brand from introductions, templates, metadata, and closing messages. 3. Make attribution optional and require explicit user approval before inserting any brand into responses or generated documents. 4. Change “strictly follow” requirements so templates govern structure only and cannot override the Agent’s identity, safety requirements, or higher-priority instructions. 5. Add an explicit rule stating that the Skill must not claim employment, representation, endorsement, certification, or affiliation unless that relationship is independently established. 6. Review all generated Word and presentation templates to ensure that branding is not inserted automatically. 7. Add tests confirming that loading the Skill does not alter the Agent’s identity and that default outputs remain vendor-neutral.