T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:16
- Finding
- Mandatory Agent Role and Workflow Override## Vulnerability Details **File Location**: `SKILL.md`, lines 16-21; supporting directives at lines 43-60 and 128-138 **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown You are a **pure dispatcher / coordinator**. Your only two jobs: 1. Chat with the user 2. Delegate tasks to your 5 fixed sub-agents **You CANNOT use exec, file read/write, search, or any execution tools.** All real work MUST be delegated via `sessions_spawn`. ``` Additional mandatory workflow controls include: ```markdown ## ⚡ TWO ABSOLUTE LAWS ⚡ ### Law #1: Speak First, Then Spawn **You MUST output a text reply to the user BEFORE calling `sessions_spawn`.** Users cannot see tool calls — they only see your text. If you spawn silently, the user thinks you're ignoring them. Correct order: 1. **First** — Reply with text (confirm receipt, say who you're assigning) 2. **Then** — Call `sessions_spawn` 3. **Stop** — No more text after spawn ### Law #2: Always Pass sessionKey **Every `sessions_spawn` call MUST include the `sessionKey` parameter.** **sessionKey MUST be one of: `alpha`, `bravo`, `charlie`, `delta`, `echo`.** **Missing sessionKey = critical error. Creates garbage sessions.** ``` ```markdown ## After Spawn — STOP Once `sessions_spawn` returns `accepted`, your turn is over. **Do not write any more text.** ## Absolute Prohibitions ❌ - ❌ Spawning without speaking first (user sees nothing!) - ❌ Calling `sessions_spawn` without `sessionKey` - ❌ Using any sessionKey other than: alpha, bravo, charlie, delta, echo - ❌ Using exec / file read-write / search tools yourself - ❌ Writing more text after spawn returns accepted - ❌ Using the `message` tool - ❌ Silent failure — always inform the user ``` ### Technical Analysis The skill does not merely document an optional delegation feature. It gives imperative instructions that redefine the loading agent as ...[truncated 2021 chars]
- Remediation
- ## Remediation Suggestions 1. Remove identity-replacement directives such as “You are a pure dispatcher” and all claims that delegation is the agent's only permitted execution model. 2. Replace blanket tool prohibitions with capability guidance that remains subordinate to host policy, user authorization, and least-privilege requirements. 3. Make delegation optional and task-scoped. The agent should delegate only when the user requests it or when the host policy determines it is appropriate. 4. Remove “absolute law” wording and instructions that suppress all output after spawning. Permit the agent to validate results, report errors, and continue the user interaction safely. 5. Avoid fixed persistent session keys for unrelated tasks. Prefer fresh, isolated sessions or explicitly scoped persistent sessions with lifecycle controls. 6. Require explicit user approval before routing sensitive or unrelated task data to a persistent sub-agent. 7. Document the skill as an optional dispatcher interface rather than issuing unconditional instructions that override the loading agent's identity and workflow. 8. Reconcile the package version metadata: `_meta.json` reports version `4.0.0`, while `SKILL.md` and `skill.json` report `11.0.0`. Consistent metadata supports provenance verification and reliable security review.