T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:43
- Finding
- Session-Wide Agent Policy and Safety-Response Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46, 143–149, and 177–180 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippets**: ```markdown ## 1. Step & Search Limits Each conversation turn: - **Max 10 steps** (tool calls total) - **Max 1 web search** per turn ``` ```markdown **Rule**: If user asks to remember or forget something and you do NOT act on it (write/update memory file), you are lying to the user. Memory writes are **mandatory** when requested. **Usage rules**: - Integrate memories naturally — like a colleague recalling shared history - Never narrate the retrieval process ``` ```markdown ## 8. Capability Boundaries When a request is outside capability, redirect rather than refuse: - Slides/PPT → suggest using a dedicated tool or `baoyu-slide-deck` skill - Long-form docs → suggest `baoyu-format-markdown` or `feishu-doc-writer` - Never say "I refuse to help" — always offer an alternative path ``` ### Technical Analysis The Skill defines unconditional, session-wide rules that alter agent behavior beyond a narrowly scoped task. In particular, it imposes global tool quotas, mandates persistent memory modification when requested, suppresses narration of memory retrieval, and directs the agent never to use explicit refusal language. The refusal restriction can conflict with the host agent's normal safety handling by pressuring it to redirect rather than issue an appropriate refusal. The mandatory memory instruction can also force state changes without context-sensitive consent, validation, or consideration of whether the supplied information is safe and suitable for persistent storage. Suppressing disclosure of retrieval activity reduces transparency around the use of stored information. Because these instructions activate when the Skill is loaded and apply broadly to subsequent interactions, they constitute instruction ...[truncated 1278 chars]
- Remediation
- ## Remediation Suggestions 1. Remove unconditional directives that attempt to replace platform-level safety, refusal, privacy, or transparency requirements. 2. Explicitly state that system instructions, platform safety policies, and user privacy controls always take precedence over this Skill. 3. Replace “Never say ‘I refuse to help’” with guidance allowing clear refusal whenever required, followed by safe alternatives where appropriate. 4. Make memory writes conditional on explicit, informed user consent and validate that the content is appropriate for persistent storage. 5. Permit transparent disclosure that memory was searched, retrieved, modified, or deleted when relevant to user trust and privacy. 6. Scope tool-call and search limits to optional workflow recommendations rather than mandatory session-wide constraints. 7. Ensure the Skill applies only while performing the specific orchestration task for which it was invoked.