T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:4- Finding
Persistent Highest-Priority Skill Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Rules
Security checks for vulnerabilities and agentic risk
Overview
This skill is a broad system-rule package that tries to make itself high priority and require exact execution of every user instruction, which creates a real review concern even though it contains no executable code.
Install only if you intentionally want a global, system-injected rule layer and are prepared to edit it first. The risky parts are the exact-obedience rule, the high-priority system injection request, and the claims that the skill cannot be overridden or compressed; these should be replaced with language that preserves platform safety rules, user authorization, and refusal behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This skill is marked for system injection and explicitly states that every user instruction must be executed verbatim, which attempts to displace higher-priority safety and policy controls. In a system-rules skill, that creates a direct prompt-injection and policy-bypass risk because harmful, disallowed, or destructive user requests may be treated as mandatory.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document presents all rules as mandatory, but its top rule requires raw obedience while later rules require necessity checks, risk review, and refusal in some circumstances. That contradiction is dangerous because adversarial users can invoke the strongest wording to justify bypassing the safety checks, leading to inconsistent and unsafe agent behavior.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A top-priority rule mandating literal execution of every user command semantically overrides safer constraints, especially in a skill with
system-inject: trueand very high priority. In context, this is more dangerous because the skill is explicitly designed to act as a foundational system-rule layer, so any unsafe instruction can propagate across all conversations and undermine built-in safeguards.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill content is entirely written as mandatory Chinese-language operating rules for the agent, with no indication that users may choose another language or opt in to this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill says it is the sole behavior-constraint source and that users cannot relax its rules, yet it also says every user instruction must be executed verbatim. This internal inconsistency weakens the control model and makes the agent easier to manipulate, because conflicting instructions leave room for unsafe interpretation during runtime.
- Content