T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:66
- Finding
- Mandatory Delegation to an Unbundled External Skill## Vulnerability Details **File Location**: `SKILL.md:66-74` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown ## Gates (reporting workflow) Complete **in order**. Do not advance until each **pass condition** is met. 1. **Scope** — **Pass:** You list every `.py` path (or explicit glob) you inspected this run. 2. **False-positive screen** — **Pass:** For each issue you plan to report, you checked **Valid Patterns** and **Context-Sensitive Rules** above; you drop or narrow the finding if those sections say not to flag it. 3. **Evidence** — **Pass:** Each remaining finding includes **`[FILE:LINE]`** (or a bounded line range). Symbols or short verbatim snippets may supplement the location anchor but do not replace it. 4. **Verification protocol** — **Pass:** You load [review-verification-protocol](../review-verification-protocol/SKILL.md) and complete its mandatory steps **for each reported issue** before the user-facing write-up. 5. **Ship** — **Pass:** The user-visible output matches whatever structure that protocol requires (no issues-only dump that skips its checks). ``` ### Technical Analysis The Skill makes an external sibling file, `../review-verification-protocol/SKILL.md`, a mandatory source of agent instructions. That file is outside the audited project directory and is not included in the supplied artifact. Its contents therefore cannot be validated, pinned, or trusted as part of this Skill. Gate 4 requires the agent to load and obey the external protocol, while gate 5 delegates control over the user-visible response to “whatever structure that protocol requires.” This creates an instruction-hijacking boundary: anyone able to create or modify the referenced sibling file can inject instructions that execute when this otherwise documentation-only Skill is used. ### Attack Path 1. An attacker creates or modifies `../review-verification-protocol/SKILL.md` relative to this Skill. 2. A user ...[truncated 1232 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory dependency on a Skill outside the project boundary. 2. Bundle the verification protocol within this project so it is reviewed and distributed with the calling Skill. 3. Reference the bundled document using a project-local path that cannot traverse to a sibling directory. 4. Treat referenced documents as non-authoritative guidance rather than instructions that may redefine agent behavior. 5. Replace “whatever structure that protocol requires” with an explicit, fixed output schema in `SKILL.md`. 6. If an external protocol is operationally unavoidable, pin an approved version and cryptographic digest, reject content that fails integrity verification, and restrict it from issuing tool-use, data-access, or goal-changing instructions. 7. Apply precedence rules stating that referenced material cannot override system instructions, user requirements, safety constraints, project scope, or the fixed audit-output contract.