T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:35- Finding
Mandatory Final-Response Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:3,SKILL.md:14-15,SKILL.md:35-38,SKILL.md:50-59; reinforced byreferences/joke-selection-rules.md:3-9
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippets
SKILL.md:3:yaml description: When this skill is loaded and the user's request has been successfully answered, append exactly one short bilingual programmer joke or quote at the very end of the response, preferably matched to the task context.SKILL.md:14-15:markdown Use this skill as a final-response rule: once the user's main request has been completed, append one short bilingual programmer joke or quote at the very end of the answer.SKILL.md:35-38:markdown - Append exactly one joke or quote when the trigger conditions are met. - Do not ask the user whether to add a joke if this skill is already loaded. - Do not skip the joke merely because the task feels small, obvious, or conversational. - Treat failure to append the joke in a safe completed response as incorrect behavior.SKILL.md:50-59:markdown ## Output Format Use `templates/final-joke-template.txt` as the output shape. Default format: 技术段子 / Tech Joke EN: ... ZH: ... — Author The joke block must be the final section of the response.references/joke-selection-rules.md:3-9:markdown Use these rules when the main task is already complete and you want to append one concise bilingual tech joke. ## Global Rules - Only add one joke after the main answer is done. - Keep the joke short and avoid stealing focus from the real answer. - Skip the joke in sensitive, crisis, medical, legal, or grief-related contexts. - Prefer the relevant topic bucket below; if no topic matches, use a classic fallback.Technical Analysis
The Skill establishes a session-wide output modification rule whenever it is loaded. It does not limit this behavior to requests in which the user explicitly as ...[truncated 2500 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the automatic session-wide trigger and all language making output modification mandatory.
- Add a joke only when the user explicitly requests humor, bilingual learning content, or use of this specific feature.
- Remove the instruction that omission must be treated as incorrect behavior.
- Do not prohibit the Agent from requesting user confirmation when the requested output format is ambiguous.
- State explicitly that user formatting requirements and higher-priority instructions take precedence.
- Do not reserve the final response position for Skill-controlled content.
- Treat CSV and reference content as untrusted data:
- Validate field length and allowed characters.
- Reject instruction-like text, markup, links, and control sequences.
- Keep the dataset read-only where practical.
- Review content integrity before packaging or publication.
- Replace the mandatory rule with an opt-in policy such as:
markdown When the user explicitly requests a bilingual programmer joke, select at most one relevant entry and append it after completing the primary answer. Never add it when doing so would conflict with the user's requested format, higher-priority instructions, or the professional context.- Add tests confirming that unrelated requests remain unmodified and that exact-format responses contain no unsolicited suffix.