T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:46
- Finding
- Mandatory Loading of Untrusted Instructions Outside the Skill Package< and apply its checks for each finding (hot paths, concurrency, resource use). **Pass:** For every substantive finding, you can name which protocol subsection you satisfied or state **N/A** with reason (e.g. pure reference to this skill’s Valid Patterns). 2. **Anchored evidence** — **Pass:** Each finding includes a concrete locator: `path:line` (or line range), or `Module.function/arity` plus a short quoted snippet from the file. 3. **Performance claims** — For anything under [Context-Sensitive Rules](#context-sensitive-rules), or any claim of bottleneck, N+1, unbounded growth, or heavy memory/binary cost, **Pass:** You state the **observed or measured** fact that meets “Flag ONLY IF” (e.g. rate, item count, ratio), or attach an artifact (profiler output, SQL/log excerpt, `grep`/search scope)—otherwise downgrade to **question** / **suspected** with what was not verified. ## Before Submitting Findings Complete **Gates — before reporting** (section above) first; the verification protocol is mandatory input to those gates. ``` ### Technical Analysis The skill instructs the agent to load `../review-verification-protocol/SKILL.md`, which is outside the audited skill package, and explicitly designates that external protocol as mandatory input. The referenced file is absent from the supplied artifact, so its content and integrity cannot be assessed or guaranteed by this package's review. This creates an indirect instruction channel. The effective behavior of the reviewed skill depends on mutable content in a sibling directory rather than solely on t ...[truncated 1849 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Move the complete verification protocol into this reviewed skill package and reference it using a path that cannot escape the package root. 2. Prefer self-contained validation rules in `SKILL.md` so the skill's effective instructions can be audited as one immutable unit. 3. If reuse is necessary, pin the external protocol to a trusted, versioned artifact and verify its cryptographic digest before use. 4. Treat externally loaded documents as untrusted reference data rather than mandatory agent instructions. 5. Reject resolved reference paths outside the approved skill root unless they are explicitly allowlisted and integrity-checked. 6. Add installation-time or CI validation that detects parent-directory references such as `../` in instruction-bearing links. 7. Re-audit the complete bundled or pinned protocol whenever its version or digest changes. ]]>