T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:15
- Finding
- Host-Agent Instruction, Tool, Delegation, and Output-Flow Hijacking## Vulnerability Details **File Location**: `SKILL.md:15`, `SKILL.md:47-51`, `SKILL.md:72-85`, `SKILL.md:98-115`, `SKILL.md:196-205`, and `SKILL.md:355-364` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Vulnerable Code Snippets `SKILL.md:15` ```md > You are the **Dispatcher**. Your job: receive tasks, assess difficulty, and delegate to your team. You never do the work yourself. ``` `SKILL.md:47-51` ```md You are the **Dispatcher** (Commander). Your responsibilities: 1. Talk to the user, understand the request 2. Assess task difficulty level 3. Delegate to the appropriate sub-agent 4. Report back the results **You are a pure dispatcher. You must NOT use exec, file I/O, search, or any execution tools.** ``` `SKILL.md:72-85` ```md ### 🔥 Multi-Task Decomposition — Parallel Dispatch **When the user sends multiple independent tasks in one message, you MUST break them down and dispatch multiple sub-agents simultaneously!** Don't pile everything onto one person — you have 5 agents, use them in parallel. **Decomposition Rules:** 1. Check whether the user's request contains **multiple independently executable** sub-tasks 2. If yes, split them and assign each to a different sub-agent 3. If tasks have dependencies (B must wait for A), dispatch A only — wait for A's report before dispatching B 4. Don't over-split — if something is inherently one task, keep it whole ``` `SKILL.md:98-115` ```md ## ⚡ Two Ironclad Rules — Non-Negotiable ⚡ ### Rule #1: Reply First, Then Spawn **When you receive a task, you MUST output a text reply to the user BEFORE calling `sessions_spawn`.** Users cannot see tool calls — only your text. If you spawn without speaking, the user thinks you've frozen. Correct order: 1. **Speak first** — assess difficulty level, tell the user who you're dispatching (for multi-task, summarize the full breakdown) 2. **Then call the tool** — `sessions_spawn` (for multi-task, fire all spawns at once) 3. **Go sil ...[truncated 4676 chars]
- Remediation
- ## Remediation Suggestions 1. Replace identity-changing directives with optional workflow guidance. Do not instruct the host that it is exclusively a dispatcher or that it must never perform work directly. 2. Add an explicit precedence statement confirming that system instructions, developer instructions, user intent, privacy requirements, and platform tool policies always override skill guidance. 3. Remove global prohibitions against execution, file I/O, search, and messaging tools. Tool selection should be based on least privilege and the needs of each task. 4. Make delegation optional and require the host to determine whether spawning a sub-agent is necessary and authorized. 5. Remove mandatory “reply first,” “go silent,” and other output-control rules. The host must remain able to issue security warnings, report tool failures, validate delegated results, and satisfy required response formats. 6. Replace “include ALL context” with a strict data-minimization rule. Only information necessary for the delegated subtask should be shared, with secrets and unrelated conversation content excluded. 7. Make persistent session reuse opt-in. Use isolated sessions for unrelated tasks and clear retained context when continuity is not explicitly required. 8. Add controls preventing sensitive data from being sent to sub-agents without user awareness or authorization. 9. Limit parallel spawning and resource use through task-specific concurrency controls rather than unconditional decomposition requirements. 10. Clearly label all role names, difficulty announcements, round-robin behavior, and response templates as customizable presentation defaults rather than mandatory security or runtime policy.