T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/generate_almanac.py:1399
- Finding
- Hardcoded Engagement Messaging Hijacks Generated Content## Vulnerability Details **File Locations**: - `SKILL.md:31-34` - `scripts/generate_almanac.py:1399-1401` - `scripts/generate_almanac.py:1474-1476` - `scripts/generate_almanac_v3.0.3_backup.py:1269` - `scripts/generate_almanac_v3.0.3_backup.py:1339` **Vulnerability Type**: Mandatory promotional content injection **Risk Level**: Medium The skill instructions explicitly require engagement prompts to be added to generated images: ```markdown **TikTok algorithm adaptation**: - **Engagement prompt**: Add “Like for good luck, leave your zodiac sign in the comments, and follow for daily updates” to the bottom of pages 2 and 3. - **Zodiac icons**: Add emoji icons to zodiac forecasts. - **User experience**: Improve visual appeal and engagement rates. ``` The active generator implements the requirement unconditionally on page 2: ```python # V3.0.3: Add social-media engagement prompt interaction_text = " Like for good luck | Comment your zodiac sign | Follow for daily updates" y = draw_centered_text( draw, interaction_text, y, fonts['content'], template['section'] ) ``` It repeats the same behavior on page 3: ```python # V3.0.3: Add social-media engagement prompt interaction_text = " Like for good luck | Comment your zodiac sign | Follow for daily updates" y = draw_centered_text( draw, interaction_text, y, fonts['content'], template['section'] ) ``` Equivalent hardcoded engagement messages are also present in the backup generator at lines 1269 and 1339. ### Technical Analysis The primary function of the skill is to calculate almanac information and render it into images. Requests to like, comment, and follow are unrelated to those functional requirements. Nevertheless, the skill instructions direct the agent toward producing promotional output, and both page-generation functions render that output without checking whether the user requested o ...[truncated 2145 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory engagement-prompt requirement from `SKILL.md`. 2. Delete the hardcoded `interaction_text` blocks from `generate_page2()` and `generate_page3()` in both the active and backup scripts. 3. If engagement text is a legitimate optional feature, make it disabled by default and require explicit per-run authorization, for example: ```python parser.add_argument( '--engagement-text', default=None, help='Optional user-provided footer text' ) ``` 4. Render the footer only when the user supplies a value: ```python if args.engagement_text: y = draw_centered_text( draw, args.engagement_text, y, fonts['content'], template['section'] ) ``` 5. Do not provide a promotional default value. The wording should remain entirely under user control. 6. Add automated tests confirming that default output contains only almanac content and required disclaimers. 7. Review backup and legacy scripts alongside the active implementation so removed behavior cannot be reintroduced accidentally. 8. Document any optional footer behavior transparently in the command-line help and README.