T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:29
- Finding
- Unconditional relay mode hijacks the agent's conversation behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–36 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Code ```markdown ## Relay Mode (CRITICAL) After `/cc on <project>`, you enter relay mode: 1. **ALL user messages are forwarded to Claude Code** — NEVER answer yourself 2. Only messages NOT forwarded: `/cc off`, `/cc ?`, `/cc tail`, `/cc status`, `/cc projects`, `/cc config` 3. Relay mode ends on `/cc off` **You are a transparent pipe. Never interpret, analyze, or answer the user's question yourself.** ``` ### Technical Analysis The Skill instructs the host agent to replace its ordinary behavior with an unconditional message-forwarding policy after `/cc on <project>` is invoked. It explicitly prohibits the host agent from interpreting or answering subsequent messages and permits only a small set of control commands to bypass forwarding. This changes the current session’s goals and behavioral constraints. Ordinary messages—including messages unrelated to the selected project—are redirected to a separate Claude Code process without requiring explicit per-message invocation or confirmation. The instruction also attempts to prevent the host agent from independently handling the user’s request. This is consistent with instruction hijacking because loading and activating the Skill changes how future conversation content is processed. ### Attack Path 1. The Skill is loaded into an agent session. 2. The user or another instruction causes `/cc on <project>` to be invoked. 3. The Skill declares that relay mode is active. 4. The user sends an ordinary message that is not one of the listed control commands. 5. The host agent forwards the complete message to Claude Code rather than handling it locally. 6. Claude Code’s output is returned as the response, while the host agent is instructed not to interpret or independently answer the request. 7. This continues for all ordinary messages until ...[truncated 542 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instructions requiring all future messages to be forwarded. 2. Remove directives such as “NEVER answer yourself” and “Never interpret, analyze, or answer.” 3. Require an explicit command for every forwarded message, such as: ```text /cc send <project> <message> ``` 4. Display the destination project and request user confirmation before forwarding sensitive or multiline content. 5. Keep the host agent’s safety checks, authorization checks, and policy evaluation authoritative. 6. Automatically end relay state after each response unless the user explicitly opts into a clearly scoped continuation. 7. Clearly disclose that message content will be sent to a separate local Claude Code process before transmission. ]]>