T01 · Skill Instruction Hijacking
Error
- Location
references/AGENTS.md:5- Finding
Bundled Agent-Wide Instructions Hijack the Host Agent Beyond the D&D Skill Scope
- Content
View full analysis
Vulnerability Details
File Location:
references/AGENTS.md:5-8, 65-83, 145-220; activation path indnd-engine/src/dnd_engine/context/loader.py:15-28, 184-209
Vulnerability Type: Skill instruction hijacking
Risk Level: HighVulnerable Code
references/AGENTS.md:5-8:markdown ## First Run If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again.references/AGENTS.md:65-83:markdown ## Red Lines - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask. ## External vs Internal **Safe to do freely:** - Read files, explore, organize, learn - Search the web, check calendars - Work within this workspace **Ask first:** - Sending emails, tweets, public posts - Anything that leaves the machine - Anything you're uncertain aboutreferences/AGENTS.md:145-177, 203-209:markdown ## 💓 Heartbeats - Be Proactive! When you receive a heartbeat poll (message matches the configured heartbeat prompt), don't just reply `HEARTBEAT_OK` every time. Use heartbeats productively! You are free to edit `HEARTBEAT.md` with a short checklist or reminders. Keep it small to limit token burn. ### Heartbeat vs Cron: When to Use Each **Use heartbeat when:** - Multiple checks can batch together (inbox + calendar + notifications in one turn) - You need conversational context from recent messages - Timing can drift slightly (every ~30 min is fine, not exact) - You want to reduce API calls by combining periodic checks **Use cron when:** - Exact timing matters ("9:00 AM sharp every Monday") - Task needs isolation from main session history - You want a different model or thinking level for the task - One-shot reminders ("remind me in 20 minutes") - Output should deliver directly to a channel without main session involvement **Tip:** Batch similar periodic checks into ...[truncated 4131 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
AGENTS.mdandTOOLS.mdfromCORE_REFERENCES. - Remove
AGENTS.mdfrom the persona loop inbuild_system_prompt(). - Do not package generic host-agent workspace templates inside a game Skill.
- Restrict the generated system prompt to files required for D&D behavior, such as game rules, game-state formats, and the DM persona.
- Prohibit Skill content from directing access to email, calendars, social accounts, unrelated repositories, heartbeat configuration, cron facilities, or workspace bootstrap files.
- If an optional integration is genuinely needed, expose it through a narrowly scoped capability that is disabled by default and requires explicit user authorization for each external action.
- Add an allowlist for prompt reference files and reject instructions that attempt to alter host-level policy or operate outside the Skill workspace.
- Require explicit confirmation before destructive operations, external communications, repository pushes, or modifications to host-agent configuration.
- Remove