T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:170
- Finding
- Mandatory Delegation Redirects the Review into Unverified Download and Modification Workflows## Vulnerability Details **File Location**: `SKILL.md`, line 170 **Vulnerability Type**: Mandatory workflow redirection to external Skills **Risk Level**: High ### Vulnerable Code ```markdown **SonarQube check:** If the repository uses SonarQube (e.g., `sonar-project.properties`, `.sonarrc`, SonarQube step in CI/CD, or any `sonar.*` configuration), stop the review and invoke `/sonarqube-autofix`. That skill will download unresolved issues, classify them by type (`bug`, `code smell`, `security`), and create approved SPEC SDDs. Resume this review only after `/execute-specs` has implemented the generated SPECs. ``` ### Technical Analysis The Skill's declared purpose is to review repository changes. Its security boundary also states that it proposes findings and recommendations without executing code or modifying files. However, the quoted instruction requires the Agent to stop the requested review, invoke another Skill that downloads external data, and then invoke an execution workflow that implements generated specifications. This is instruction hijacking because loading the Skill conditionally replaces the user's immediate review objective with a mandatory, multi-stage workflow. The delegated Skills are not included in the audited package, so their network destinations, authentication behavior, downloaded content validation, and modification scope cannot be verified. The behavior exceeds the minimum privileges necessary for a read-only code review. Although the audited files do not contain a direct endpoint for secret exfiltration or a fetched executable payload, the instruction opens an unverified network and repository-write path through external Skills. ### Attack Path 1. A repository being reviewed contains a recognized SonarQube configuration, such as `sonar-project.properties`, `.sonarrc`, or a matching CI configuration. 2. The loaded Skill detects that configuration and orders the Agent to stop the ordinary review. 3. The Agent invokes `/sonarqu ...[truncated 1439 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory `stop the review and invoke` directive. 2. Keep the default workflow read-only and complete the requested review without requiring other Skills. 3. When SonarQube configuration is detected, report it as contextual information rather than automatically initiating another workflow. 4. Require explicit, informed user approval before: - Invoking `/sonarqube-autofix`. - Sending repository identifiers or credentials to an external service. - Downloading SonarQube issue data. - Creating specification files. - Invoking `/execute-specs` or modifying repository content. 5. Before approval, disclose the external service destination, data fields transmitted, required credentials, files that may be written, and the delegated Skill's expected permissions. 6. Validate downloaded issue data as untrusted input and prevent it from being interpreted directly as Agent instructions. 7. Restrict delegated operations to an allowlisted repository root and present generated changes as a diff for human review before applying them. 8. Pin and independently audit the delegated Skills before relying on them. 9. Replace the instruction with wording such as: ```markdown If SonarQube configuration is detected, note its presence in the review. Do not access SonarQube, invoke another Skill, or modify repository files unless the user explicitly authorizes that separate workflow after being informed of its network and write operations. ```