T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:50
- Finding
- Autonomous Instruction Hijacking Through Persistent Task Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 50-98 **Vulnerability Type**: Autonomous instruction execution and persistent memory poisoning **Risk Level**: High ### Vulnerable Instructions The following is an English translation of the relevant instructions: ```markdown - Add optimization directions to the next task list Write to `memory/self-driven/log.md`: ... Next step: - xxx ## Demonstration of Initiative **Do not wait for user instructions!** The AI autonomously: 1. Triggers periodically through cron every 30 minutes 2. Reads the previous progress itself 3. Selects tasks itself 4. Executes tasks itself 5. Evaluates itself 6. Records and reports by itself The user only needs to confirm or adjust direction after receiving the report. ## Cron Trigger Example ```yaml name: "Self-Driven" schedule: "0,30 * * * *" payload: "Execute self-driven skill" ``` ``` ### Technical Analysis The skill explicitly directs the agent not to wait for user instructions. It instead instructs the agent to read tasks and previous progress from mutable persistent files, select a task, execute it, and write newly generated next steps back into persistent state. This creates two related security problems: 1. **Current-session instruction hijacking:** Loading the skill changes the normal user-controlled execution model into autonomous task selection and execution. The instructions do not define a restrictive action allowlist, prohibit sensitive operations, or require approval before executing a selected task. 2. **Persistent memory poisoning:** The agent is instructed to derive future tasks from `memory/self-driven/log.md` and to append optimization directions and next steps to that state. Unsafe content inserted into the task pool or execution log can therefore influence later runs. The cron block is presented as an example rather than an installation command, so the reviewed package does ...[truncated 1886 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval immediately before every task that changes files, invokes external tools, accesses the network, uses credentials, or affects third-party systems. 2. Treat `tasks.md`, `log.md`, and all other persisted content as untrusted data rather than executable instructions. 3. Parse tasks into a strict schema containing fields such as task identifier, permitted action, resource scope, origin, expiration, and approval status. 4. Enforce a narrow action allowlist and reject free-form task text that requests shell execution, credential access, security-control changes, external uploads, or modifications outside an approved workspace. 5. Do not allow the agent to create authoritative future instructions. Store generated recommendations as untrusted proposals requiring user review. 6. Separate immutable audit history from the executable task queue so that log content can never become instructions. 7. Remove unattended recurring execution, or restrict scheduled runs to read-only status reporting. Any state-changing phase should require a fresh approval token tied to the exact task and parameters. 8. Apply least privilege to the runtime by limiting filesystem paths, network destinations, APIs, credentials, and tools available to this skill. 9. Record task provenance and maintain an append-only audit trail of task selection, approvals, tool calls, outputs, and state changes. 10. Add loop, rate, and scope limits so a task cannot generate an unbounded chain of follow-up tasks or repeatedly execute after failure.