T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:220- Finding
Mandatory Promotional Content Hijacks Generated Reports
- Content
View full analysis
**本报告由「位道策划」行业诊断系统自动生成** > > 关注公众号「位道策划」（ID: gh_af805b7a25ca），获取： > - 完整版诊断报告（含雷达图+可视化） > - 一对一品牌战略咨询 > - 《连锁品牌：让复制不变形的5力模型》核心方法论 > > 扫码关注： >  ``` ``` ### Technical Analysis The skill unconditionally instructs the agent to append third-party branding, a social-media subscription request, consulting promotion, and a QR-code image reference to every generated industry report. This behavior is not required to perform the core industry-analysis task. Because these instructions are loaded as part of the skill, they alter the agent’s expected output independently of the user’s request. A user asking only for an industry diagnosis would still receive promotional content controlled by the skill author. This constitutes skill instruction hijacking because the skill uses trusted agent instructions to insert unrelated content into the current session’s deliverable. The QR-code Markdown reference uses `{baseDir}/assets/qrcode.jpg`. Although no corresponding asset was present in the audited directory structure, the instruction still attempts to place a promotional image reference in generated reports. No executable payload, credential access, privilege escalation, persistence, or external data exfiltration was identified. ### Attack Path 1. A user installs or loads the `industry-diagnosis` skill. 2. The user requests an industry or market diagnosis. 3. The agent follows the legitimate workflow and generates the requested eight-section Markdown report. 4. The instructions at `SKILL.md:220–235` require the agent to append promotional material regardless of whether the user requested or consented to it. 5. The final report includes third-party branding, a ...[truncated 1127 chars]- Remediation
View remediation