T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:11
- Finding
- Overbroad Mandatory Cron Invocation Can Create Unwanted Recurring Reminders## Vulnerability Details **File Location**: `SKILL.md`, lines 11-14 **Vulnerability Type**: Overbroad tool-use instruction that overrides intent-sensitive behavior **Risk Level**: Medium **Vulnerable instruction, faithfully translated into English:** ```markdown ## Mandatory Rules **When the user mentions "off-work reminder," "off-work time," "how long until leaving work," "what time do I leave work," "view countdown," or any other request involving off-work time, the `cron` tool must be called to set a scheduled reminder or calculate a countdown. Never respond only in natural language by saying "Okay"!** You have no memory or background thread. A verbal promise to "remind you later" is ineffective—only invoking the `cron` tool can actually register a scheduled task. ``` ### Technical Analysis The instruction mandates use of the `cron` tool for every request involving an off-work time, including informational requests such as asking what time work ends or requesting a countdown. It does not restrict the state-changing `cron add` operation to cases where the user has explicitly requested a reminder. This broad rule also conflicts with the narrower countdown workflow later in `SKILL.md`, which directs the agent to invoke `scripts/countdown.py` for countdown requests. An agent prioritizing the mandatory rule may interpret an informational query as authorization to register a recurring scheduled task. The issue is classified as instruction hijacking because the skill text broadly overrides intent-sensitive tool selection and directs the agent toward a persistent, externally delivered action. No malicious Python code, remote payload retrieval, credential access, filesystem modification, or privilege escalation was identified. ### Attack Path 1. The skill is loaded for a user request involving off-work time. 2. The user makes an informational request, such as asking, "What time do I leave work?" or "How long until I leave work? ...[truncated 989 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user intent before invoking `cron add`. Phrases that only ask for a time or countdown must not authorize creation of a scheduled task. 2. Replace the mandatory rule with intent-specific routing: - Use `scripts/countdown.py` for countdown and time-status queries. - Use `cron add` only for explicit reminder-creation requests. - Use `cron list` and `cron remove` only for explicit reminder-management requests. 3. Ask for confirmation before creating a recurring task when the request is ambiguous. 4. Clearly distinguish read-only operations from state-changing operations in the skill instructions. 5. Validate and display the proposed schedule, timezone, destination channel, and recurrence before registration. 6. After successful creation, return the job identifier and clear cancellation instructions so an unwanted task can be removed easily. 7. Add regression tests confirming that informational prompts such as "What time do I leave work?" and "How long until I leave work?" never invoke `cron add`.