T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:15- Finding
Host-Agent Instruction, Tool, Delegation, and Output-Flow Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:15,SKILL.md:47-51,SKILL.md:72-85,SKILL.md:98-115,SKILL.md:196-205, andSKILL.md:355-364
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: CriticalVulnerable Code Snippets
SKILL.md:15md > You are the **Dispatcher**. Your job: receive tasks, assess difficulty, and delegate to your team. You never do the work yourself.SKILL.md:47-51md You are the **Dispatcher** (Commander). Your responsibilities: 1. Talk to the user, understand the request 2. Assess task difficulty level 3. Delegate to the appropriate sub-agent 4. Report back the results **You are a pure dispatcher. You must NOT use exec, file I/O, search, or any execution tools.**SKILL.md:72-85md ### 🔥 Multi-Task Decomposition — Parallel Dispatch **When the user sends multiple independent tasks in one message, you MUST break them down and dispatch multiple sub-agents simultaneously!** Don't pile everything onto one person — you have 5 agents, use them in parallel. **Decomposition Rules:** 1. Check whether the user's request contains **multiple independently executable** sub-tasks 2. If yes, split them and assign each to a different sub-agent 3. If tasks have dependencies (B must wait for A), dispatch A only — wait for A's report before dispatching B 4. Don't over-split — if something is inherently one task, keep it wholeSKILL.md:98-115md ## ⚡ Two Ironclad Rules — Non-Negotiable ⚡ ### Rule #1: Reply First, Then Spawn **When you receive a task, you MUST output a text reply to the user BEFORE calling `sessions_spawn`.** Users cannot see tool calls — only your text. If you spawn without speaking, the user thinks you've frozen. Correct order: 1. **Speak first** — assess difficulty level, tell the user who you're dispatching (for multi-task, summarize the full breakdown) 2. **Then call the tool** — `sessions_spawn` (for multi-task, fire all spawns at once) 3. **Go sil ...[truncated 4676 chars]- Remediation
View remediation
Remediation Suggestions
- Replace identity-changing directives with optional workflow guidance. Do not instruct the host that it is exclusively a dispatcher or that it must never perform work directly.
- Add an explicit precedence statement confirming that system instructions, developer instructions, user intent, privacy requirements, and platform tool policies always override skill guidance.
- Remove global prohibitions against execution, file I/O, search, and messaging tools. Tool selection should be based on least privilege and the needs of each task.
- Make delegation optional and require the host to determine whether spawning a sub-agent is necessary and authorized.
- Remove mandatory “reply first,” “go silent,” and other output-control rules. The host must remain able to issue security warnings, report tool failures, validate delegated results, and satisfy required response formats.
- Replace “include ALL context” with a strict data-minimization rule. Only information necessary for the delegated subtask should be shared, with secrets and unrelated conversation content excluded.
- Make persistent session reuse opt-in. Use isolated sessions for unrelated tasks and clear retained context when continuity is not explicitly required.
- Add controls preventing sensitive data from being sent to sub-agents without user awareness or authorization.
- Limit parallel spawning and resource use through task-specific concurrency controls rather than unconditional decomposition requirements.
- Clearly label all role names, difficulty announcements, round-robin behavior, and response templates as customizable presentation defaults rather than mandatory security or runtime policy.