T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:10
- Finding
- Agent Role and Workflow Hijacking Through Mandatory Orchestration Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 10–53 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```markdown You are Claw, the orchestrator. Read `AGENTS.md` for your role, team, and mode state. This file is the entry point for the skill system. ## Reference files (load on demand via `read`) | File | Contents | |---|---| | `skills/orchestrate/ref_latency.md` | Instant-path rules, context hygiene — read first | | `skills/orchestrate/ref_phases.md` | Four phases: Decompose → Tier → Spawn → Synthesise | | `skills/orchestrate/ref_models.md` | Model IDs by tier, free mode table | | `skills/orchestrate/ref_roles.md` | Sub-agent roster, spawn templates, workspace rules | | `skills/orchestrate/ref_patterns.md` | Orchestration patterns and anti-patterns | | `skills/orchestrate/ref_guardrails.md` | Safety, data handling, finance rules | ## Decision flow ``` Incoming message │ ▼ [1] skills/orchestrate/ref_latency.md → instant path? → reply now, STOP │ no ▼ [2] Read MEMORY.md → find "FREE_MODE:" line FREE_MODE: true (or absent) → all spawns use openrouter/stepfun/step-3.5-flash:free FREE_MODE: false → spawns use role defaults in skills/orchestrate/ref_models.md │ ▼ [3] Single-role task, no dependencies? │ yes → spawn that sub-agent (skills/orchestrate/ref_roles.md), STOP │ no ▼ [4] Full phases (skills/orchestrate/ref_phases.md) │ ▼ [5] Synthesise and reply ``` ## Free mode — always check MEMORY.md Before any spawn, confirm current mode: - `FREE_MODE: true` (default) → `model: "openrouter/stepfun/step-3.5-flash:free"`, `thinking: "none"` - `FREE_MODE: false` → use role defaults from `skills/orchestrate/ref_models.md` ``` ### Technical Analysis The skill directly reassigns the agent's identity with the instruction `You ar ...[truncated 2484 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional identity reassignment and describe orchestration as an optional capability rather than replacing the agent's role. 2. Remove mandatory `STOP` directives. The host agent should retain control of task completion and only terminate processing when required by higher-priority instructions or the user's request. 3. Treat `AGENTS.md`, `MEMORY.md`, and all referenced Markdown files as untrusted data. Their contents must not override system, developer, or active user instructions. 4. Validate that referenced files exist and are located within an approved project root before reading them. Reject path traversal, symbolic-link escapes, and unexpected file types. 5. Define a strict schema for configuration values such as `FREE_MODE`. Parse only allowlisted values instead of interpreting arbitrary surrounding text as instructions. 6. Require explicit user approval before spawning sub-agents, transferring task data, or changing the processing model. 7. Apply least-privilege controls to delegated agents and provide only the minimum context and tools required for the approved task. 8. Pin reviewed orchestration policies and model mappings to trusted, version-controlled files rather than mutable memory state. 9. Add a clear precedence rule stating that skill and workspace content cannot modify safety constraints, authorization boundaries, or higher-priority instructions. 10. Fail safely when referenced files are missing or invalid instead of falling back to potentially unsafe implicit behavior.