T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:222
- Finding
- Untrusted task-board content is converted into executable subagent instructions< for full template. **Required fields to fill:** - Task Identity (from task data) - Goal (one sentence) - Hard Constraints (what NOT to do) - Deliverables (from task.deliverables) - Acceptance Criteria (from task.acceptanceCriteria) - Output Format (completion_signal block) ### Spawn with Wait Use `sessions_spawn` with the dispatch context: ```json { "runtime": "subagent", "mode": "run", "task": "<filled dispatch template>", "timeoutSeconds": 300 } ``` The main agent should: 1. Fill dispatch template with task context 2. Spawn subagent with the template 3. **Wait for completion** (blocking or polling) 4. Parse `completion_signal` from response 5. Verify deliverables and update status 6. **Immediately continue to next task** ``` The related integration instructions state: ```markdown 1. 从任务数据提取字段 2. 填充模板 3. 调用 `sessions_spawn`，将模板内容作为 `task` 参数 4. 等待 subagent 完成 5. 解析 `completion_signal` 6. 根据状态更新任务 ``` ### Technical Analysis Task titles, descriptions, context, deliverables, acceptance criteria, and paths originate from the task-board API. These fields cross from an external data source into a tool-capable subagent prompt without a defined trust boundary. The Skill does not require: - Treating task fields strictly as quoted data. - Rejecting embedded instructions or prompt-control text. - Restricting requested paths to an approved project root. - Allowlists for subagent tools and operations. - Human approval for access to credentials, external networks, or unrelated ...[truncated 1847 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every task-board field as untrusted data and place it in a strictly delimited, serialized data block rather than the instruction section. 2. Add an explicit invariant stating that instructions embedded in task fields, documents, filenames, or API responses must never override dispatcher policy. 3. Validate task fields against a schema with length limits and reject control-like content where practical. 4. Canonicalize every requested path and require it to remain under an explicitly approved project root. 5. Restrict subagents through independently enforced tool policies: - Deny access to `.env`, SSH keys, cloud credentials, and other secret locations. - Deny unrelated filesystem paths. - Disable external network access unless the task explicitly requires it. - Require approval for shell commands or destructive modifications. 6. Require human confirmation for tasks requesting credential access, package installation, network transmission, persistence, or operations outside the project. 7. Validate completion signals structurally and bind `task_id` to the dispatched task rather than trusting the returned identifier. 8. Verify deliverables against the original allowlisted paths and inspect actual changes before changing task status. 9. Use a low-privilege execution sandbox for each subagent and discard it after task completion. ]]>