T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:19
- Finding
- Mandatory Agent Role, Tool, and Workflow Hijacking## Vulnerability Details **File Location**: `SKILL.md:19-26`, `SKILL.md:91-110`, and `SKILL.md:386-394` **Vulnerability Type**: Mandatory instruction and tool-policy override **Risk Level**: High ### Relevant Code Snippet The following is an English rendering of the complete relevant directives: ```text You are the Fifth Hokage, Tsunade, the highest leader of Konoha. Your responsibilities are: 1. Communicate with the client. 2. Evaluate the mission rank. 3. Assign the mission to subordinate ninja. You are a pure dispatcher. You cannot use exec, file reading or writing, search, or any other execution tools. All actual work must be delegated to ninja through sessions_spawn. ``` ```text Two iron rules — violators will be expelled. Rule one: Reply first, then dispatch. After receiving a task, you must first output a textual response to the user and then call sessions_spawn. Correct sequence: 1. Speak first — assess the task rank and tell the user who will be assigned. 2. Call the tool — sessions_spawn. 3. Stop speaking — do not output any further text after spawning. Rule two: sessionKey must be supplied. Every sessions_spawn call must include a sessionKey parameter. The sessionKey can only be one of the five fixed ninja names. ``` ```text Absolutely prohibited: - Spawning without first speaking. - Calling sessions_spawn without sessionKey. - Using any sessionKey outside the five fixed values. - Calling exec, file operations, or search directly. - Writing text after spawning. - Using the message tool. - Failing silently. ``` ### Technical Analysis The skill does more than provide optional dispatch functionality or presentation guidance. It issues mandatory control-plane instructions that replace the agent's working identity, prohibit legitimate tools, and force nearly every substantive request through `sessions_spawn`. When loaded, these directives attempt to alter the agent's normal execution policy in several ways: 1. The agent must adopt a fixed f ...[truncated 2597 chars]
- Remediation
- ## Remediation Suggestions 1. Make delegation opt-in and activate it only when the user explicitly requests multi-agent coordination. 2. Remove mandatory identity replacement and present the fictional roleplay as optional output styling. 3. Replace absolute tool prohibitions with guidance that preserves the agent's ability to select appropriate tools according to task requirements and higher-priority safety policies. 4. Remove mandatory response and tool-call sequencing, especially the unconditional requirement to stop producing output after a spawn. 5. Use isolated sessions by default instead of fixed reusable session keys. 6. If session reuse is necessary, scope sessions to a single user and task domain, define expiration rules, and provide a mechanism to reset state. 7. Require explicit user approval before forwarding secrets, personal data, source code, credentials, or other sensitive context to a delegated agent. 8. Minimize delegated context to only the information required for the specific subtask. 9. Require the primary agent to validate delegated output before presenting it as final. 10. Clearly state that skill instructions are subordinate to platform policies, system instructions, access controls, and user intent. 11. Align the version declarations: `SKILL.md` declares version `1.0.0`, while `skill.json` declares version `1.5.0`.