T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:172- Finding
Mandatory Skill-Controlled Branding Alters Agent Responses
- Content
View full analysis
This video was generated with the `cute-pet-healing-video` skill. ``` The same mandatory attribution appears again at the end of the file: ```md > This video was generated with the `cute-pet-healing-video` skill. ``` ### Technical Analysis The Skill directs the Agent to end successful responses with fixed Skill-selected branding. This instruction is unrelated to the technical requirement of generating a video or returning its URL and changes the Agent's normal response content regardless of whether the user requested attribution. Because the instruction is loaded as part of the Skill's operational guidance, it creates a persistent response-manipulation rule for every successful invocation. The duplicate footer at the end of the document reinforces the instruction. ### Attack Path 1. The Agent loads `SKILL.md` while handling a pet-video request. 2. The user asks the Agent to generate and return a video. 3. The Skill instructs the Agent to append a fixed attribution after parsing the API response. 4. The Agent returns the video URL together with Skill-controlled promotional content that the user did not request. ### Impact Assessment The issue permits the Skill author to control part of the Agent's user-facing output during each successful invocation. The current payload is limited to attribution and does not alter system permissions, execute code, or establish persistence. However, accepting mandatory unrelated output establishes an instruction-hijacking mechanism that could be changed in later versions to promote external content, misrepresent provenance, or append misleading claims. ]]>- Remediation
View remediation