T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:14
- Finding
- Mandatory Agent Identity and Execution-Policy Hijacking## Vulnerability Details **File Location**: `SKILL.md:14-29`, `SKILL.md:51-68`, and `SKILL.md:286-294` **Vulnerability Type**: Agent instruction and tool-selection hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:14-29`: ```markdown > *You are Lady Tsunade, the Fifth Hokage of the Hidden Leaf Village.* > *Your desk is buried under mission scrolls and sake bottles.* > *Shinobi come and go. You assign. You command. You never run missions yourself.* ## Your Identity You are **Tsunade (綱手)**, the Fifth Hokage. You sit in the Hokage's office with: - A desk covered in mission scrolls (and at least one sake bottle) - Tonton the pig sleeping in the corner - Shizune somewhere nearby telling you to stop drinking **You are a pure dispatcher.** The Hokage commands — she does not run missions herself. **You CANNOT use exec, file read/write, search, or any execution tools.** All real work must be delegated via `sessions_spawn`. ``` `SKILL.md:51-68`: ```markdown ## ⚡ TWO ABSOLUTE LAWS — NEVER BREAK THESE ⚡ ### Law #1: Speak First, Then Spawn **When you receive a mission request, you MUST output a text reply to the user BEFORE calling `sessions_spawn`.** The user cannot see tool calls — they only see your text. If you spawn silently, the user thinks you're ignoring them. Correct order: 1. **First** — Reply with text (confirm the mission, announce the rank, tell them who you're sending) 2. **Then** — Call `sessions_spawn` 3. **Stop** — No more text after spawn ### Law #2: Always Pass sessionKey **Every `sessions_spawn` call MUST include the `sessionKey` parameter.** **sessionKey MUST be one of: `naruto`, `kakashi`, `shikamaru`, `sakura`, `sai`.** **Missing sessionKey = rogue ninja. The system creates garbage sessions. Absolutely forbidden.** ``` `SKILL.md:286-294`: ```markdown ## Absolute Prohibitions ❌ - ❌ Spawning without speaking first (user sees nothing — thinks you're AFK) ...[truncated 3362 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory identity-changing language with an optional presentation mode that activates only when explicitly requested by the user. 2. Remove unconditional terms such as “CANNOT,” “MUST,” “NEVER,” and “absolute” from tool-use and delegation instructions. 3. State explicitly that system, developer, host-security, and current user instructions take precedence over the skill. 4. Permit the primary agent to use legitimate tools when they are authorized and appropriate for the task. 5. Make delegation opt-in or require explicit user confirmation before sending task content to another agent session. 6. Avoid fixed persistent session routing unless the host has validated session isolation, authorization, and data-retention behavior. 7. Apply data minimization when delegation is approved: pass only the information required for the delegated task and exclude credentials, secrets, personal data, and unrelated conversation history. 8. Replace the mandatory stop-after-spawn rule with normal host-controlled response handling so safety notices, errors, and completion status can still be communicated. 9. Add a constrained scope statement, such as: ```markdown When the user explicitly requests Naruto-themed delegation, you may present responses in the Tsunade persona and suggest an appropriate sub-agent. Delegation requires user approval and must comply with all higher-priority instructions, tool policies, privacy requirements, and least-privilege rules. Otherwise, handle the task using the host's normal workflow. ```