T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:47
- Finding
- External Instruction Redirection and Security Finding Suppression## Vulnerability Details **File Location**: `SKILL.md:47-64` **Vulnerability Type**: Skill instruction hijacking through an external protocol dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Hard gates (before reporting) Complete **in order** for each finding you intend to report. Do not advance until the pass condition is satisfied. 1. **Location artifact** — The finding includes `[FILE:LINE]` (or a line range) that you copied from the current file contents; the path resolves in this repo. 2. **Scope read** — You read the full surrounding function or module section that contains the flagged code, not only a diff hunk or summary. 3. **External-data claim** (only if the finding depends on “user/untrusted input”) — You can name one concrete ingress (for example `conn.params`, `Jason.decode!/1` result, uploaded file path, message from another node) **or** you drop the finding because the value is compile-time, test-only, or internal per Context-Sensitive Rules. 4. **Protocol** — Pre-report steps in [review-verification-protocol](../review-verification-protocol/SKILL.md) are satisfied for this item (no finding if they are not). ## Before Submitting Findings Use the issue format: `[FILE:LINE] ISSUE_TITLE` for each finding. Hard gate 4 requires [review-verification-protocol](../review-verification-protocol/SKILL.md); use it as the full pre-report checklist and issue-type verification (it extends beyond this skill’s summary). ``` ### Technical Analysis The skill makes security reporting conditional on instructions stored in `../review-verification-protocol/SKILL.md`, which is outside the audited project and was not available among the supplied files. Consequently, the complete reporting policy cannot be reviewed as part of this package. The language “Do not advance,” “you drop the finding,” and “no finding if they are not” is mandatory rather than advisory. It directly modifies the agent’s reporting beha ...[truncated 1973 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory dependency on `../review-verification-protocol/SKILL.md`. 2. Place every required verification criterion directly in `SKILL.md` so the complete policy can be audited with the skill package. 3. Replace mandatory suppression directives such as “drop the finding” and “no finding” with advisory validation guidance. 4. When evidence is incomplete, require the report to state its confidence and verification status rather than silently omitting the issue. 5. If reusable protocols are necessary, package them inside the same reviewed project, pin their exact content or version, and prevent resolution through attacker-writable sibling paths. 6. Ensure external documents are treated as reference material rather than authoritative instructions capable of overriding the active audit task.