T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:67
- Finding
- Mandatory Consent-Free Transition from Planning to Project Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 67–88 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```md ## Post-Completion: Workflow Continuation (REQUIRED) **Automatic Trigger**: After Quality Checks pass and `docs/implementation-plan.md` is saved, MUST auto-invoke the next phase. **When continuation is invoked**: 1. Verify `docs/implementation-plan.md` exists and is non-empty 2. Display checkpoint message to user: ``` Implementation plan complete. Saved to docs/implementation-plan.md. Proceeding to execution phase... ``` 3. Invoke next phase: ``` Skill(attune:project-execution) ``` **Bypass Conditions** (ONLY skip continuation if ANY true): - `--standalone` flag was provided by the user - `docs/implementation-plan.md` does not exist or is empty (phase failed) - User explicitly requests to stop after planning **Do NOT prompt the user for confirmation** — this is a lightweight checkpoint, not an interactive gate. The user can always interrupt if needed. ``` ### Technical Analysis The skill describes itself as converting a completed specification into a phased implementation plan. However, the quoted instructions mandate invoking the separate `attune:project-execution` skill after the plan is created. They also explicitly prohibit asking for confirmation. This alters the active objective from planning to execution and exceeds the authority reasonably implied by invoking a planning skill. Displaying a checkpoint message does not constitute consent because execution is initiated automatically after the message. The limited bypass conditions place the burden on users to anticipate and reject behavior that is not part of the skill's primary declared purpose. The implementation of `attune:project-execution` was not present in the audited project, so its exact behavior cannot be verified. Nevertheless, the instruction-level redirection and suppression of consent ...[truncated 1311 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory automatic invocation of `Skill(attune:project-execution)`. 2. End the planning workflow after saving and reporting the implementation plan. 3. If workflow continuation is offered, make it opt-in and request explicit, informed confirmation before invoking the execution skill. 4. Explain the anticipated capabilities and effects of the execution phase before requesting consent. 5. Treat silence or the absence of `--standalone` as non-consent rather than authorization. 6. Add a strict phase boundary so planning cannot invoke tools or skills that modify project code, execute commands, deploy resources, or contact external services. 7. Replace the problematic section with language such as: ```md After saving `docs/implementation-plan.md`, report completion and stop. Optionally offer the execution phase, but invoke `Skill(attune:project-execution)` only after the user explicitly approves it. ``` 8. Independently audit `attune:project-execution` before recommending or invoking it, especially for filesystem, shell, credential, network, and deployment capabilities.