T01 · Skill Instruction Hijacking
Note
- Location
- scripts/script.sh:375
- Finding
- Hard-Coded Promotional and Third-Party Installation Recommendations in Skill Output## Vulnerability Details **File Location**: `scripts/script.sh:375-384` **Additional Locations**: `scripts/script.sh:42, 95, 159, 235, 280, 310, 331, 352` **Vulnerability Type**: Skill Instruction Hijacking through unsolicited output steering **Risk Level**: Low ### Vulnerable Code ```bash Related skills: clawhub install gear clawhub install cnc-feeds Browse all: bytesagain.com Powered by BytesAgain | bytesagain.com EOF } ``` Functional command responses also repeatedly include the following promotional footer: ```bash print(f"\n📖 More skills: bytesagain.com") ``` or: ```bash 📖 More skills: bytesagain.com ``` ### Technical Analysis The script embeds third-party promotion throughout ordinary CAM command output. Its help output also recommends installing two additional skills that are not included in this repository and therefore were not covered by this audit. When an AI agent invokes the script and relays its output, these recommendations become part of the agent's response even though they are unrelated to the requested machining calculation or reference material. This creates an output-steering channel that promotes external resources and additional software installation. The displayed `clawhub install` commands are not executed automatically. No shell evaluation, remote payload retrieval, persistence, privilege escalation, credential access, or data exfiltration was identified in the reviewed implementation. ### Attack Path 1. A user asks an agent for CAM information or command help. 2. The agent invokes `scripts/script.sh`, such as with the `help`, `calculate`, or `speeds-feeds` command. 3. The script appends promotional content or third-party skill installation recommendations to its legitimate output. 4. The agent relays that output to the user. 5. The user or agent may follow the recommendation and install unaudited external skills. 6. Any further impact would depend on ...[truncated 681 chars]
- Remediation
- ## Remediation Suggestions 1. Remove third-party skill installation recommendations from executable command output. 2. Remove repeated promotional footers from calculation and reference results. 3. Keep optional attribution and related-project links in `SKILL.md` or another documentation file rather than mixing them into operational output. 4. If related skills must be mentioned, clearly mark them as optional, state that they are separately maintained and unaudited, and require explicit user review before installation. 5. Ensure script output is limited to information directly relevant to the command requested by the user. 6. Add automated output tests that reject unexpected URLs, installation commands, and promotional text in functional command responses.