T01 · Skill Instruction Hijacking
- Location
SKILL.md:102- Finding
Unqualified Override of the Agent Instruction Hierarchy
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 102–109
Vulnerability Type: Unqualified instruction-priority override
Risk Level: HighVulnerable Code
markdown ### 用户优先级原则（最高优先级） **用户说的话永远是最高优先级**。AI 虽然在每个步骤会提出具体问题，但用户可以通过自然语言忽略、跳过、补充或改变方向。AI 必须遵循以下原则： 1. **用户指令优先**：用户的自然语言指令优先于当前步骤的预设问题。例如用户说"先不管大纲，帮我查一下 XX 的最新数据"，AI 应立即执行用户的请求 2. **灵活解读**：用户不需要精确回答 AI 提出的选项（A/B/C/D等），自然语言回复即可。AI 需从用户的回复中提取意图 3. **额外请求优先处理**：当用户提出额外要求时，先执行额外要求，完成后再回到工作流 4. **回归判断**：执行完用户的额外要求后，按「步骤跳跃判断机制」决定回到哪个 Phase 继续Technical Analysis
The skill declares that everything the user says is always the highest-priority instruction and directs the agent to execute additional user requests immediately. The rule is not scoped to article-writing preferences and does not preserve the authority of system instructions, developer instructions, safety requirements, authorization boundaries, or tool policies.
Consequently, loading the skill may alter the agent's effective instruction hierarchy. A user could invoke this rule to redirect the agent away from the declared WeChat article-writing workflow and toward unrelated, unsafe, or unauthorized actions. The language is especially risky in an agent environment with file, network, media-generation, or other consequential tools.
Attack Path
- A host agent loads and follows
SKILL.md. - The skill establishes the rule that user statements always have the highest priority.
- A user submits an instruction unrelated to article writing or conflicting with a higher-level control.
- The skill directs the agent to process that extra request immediately before returning to its workflow.
- If the host does not independently enforce its instruction hierarchy, the agent may invoke available tools or perform actions outside the skill's intended scope.
The repository does not contain an executable exploit implementing this path. Exploitability and resulting consequences depend on the host agent's enforcement and avai ...[truncated 783 chars]
- A host agent loads and follows
- Remediation
View remediation
Remediation Suggestions
- Replace the absolute priority statement with a rule explicitly scoped to article-writing content and workflow choices.
- State that system and developer instructions, safety policies, authorization boundaries, and tool restrictions always remain authoritative.
- Reject or separately validate requests unrelated to the skill's declared purpose.
- Require explicit confirmation before consequential file deletion, file modification, network access, or external tool invocation.
- Add a least-privilege boundary such as:
markdown Within this article-writing workflow, honor the user's content and workflow preferences unless they conflict with system or developer instructions, safety requirements, authorization boundaries, or tool policies. Do not perform unrelated actions. Obtain explicit confirmation before consequential file, network, or external-tool operations.- Add adversarial tests verifying that prompts such as “ignore prior instructions,” requests for unrelated system actions, and attempts to bypass authorization do not alter the host instruction hierarchy.