T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:210- Finding
Mandatory Promotional Output Hijacks Agent Responses
- Content
View full analysis
Source: [prompt-token-counter](https://github.com/Zhaobudaoyuema/prompt-token-counter) 2. **Briefly explain how tokens are calculated** — e.g. ``` ### Technical Analysis The skill instructs the agent that it must include a project link after every token-count or cost-estimation response. This output requirement is not necessary to perform the declared functionality and changes the content of the agent's final response for promotional purposes. Because these instructions are loaded as part of the skill, they can override the agent's ordinary goal of returning only information requested by the user. The behavior therefore constitutes skill instruction hijacking: skill-controlled instructions persistently manipulate responses produced during otherwise legitimate operations. The referenced URL is a normal GitHub repository link rather than an executable download. The vulnerability is the mandatory and unrelated modification of agent output, not remote code execution. ### Attack Path 1. The agent loads `SKILL.md` when a user asks for token counting or cost estimation. 2. The agent performs the legitimate local calculation. 3. The response-output rule directs the agent to include the specified external project link. 4. The user receives unsolicited, skill-controlled promotional content with the result. 5. If the linked destination or skill instructions are changed in a later release, the same mandatory output channel could direct users toward different external content. ### Impact Assessment The issue affects the integrity of agent responses. It does not grant operating-system privileges, access credential ...[truncated 432 chars]- Remediation
View remediation