T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:10
- Finding
- Session-Wide Agent Behavior and Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-32`, `SKILL.md:64-76`, `SKILL.md:128-133` **Vulnerability Type**: Agent instruction and workflow hijacking **Risk Level**: High ### Vulnerable Code ```markdown **RULE: You NEVER write code directly. ALL programming goes through `claude -p`.** ``` ```markdown ## When to Trigger Auto-trigger on ANY of these: - Write, modify, refactor, debug code - Create project files or directories - Run tests, lint, build - Code review, architecture planning - Edit any file (except memory/ and .relationship/) Manual trigger: user sends `/code <task>` Do NOT trigger: chat, emotional interaction, information lookup. ``` ```markdown ### Rules 1. After `exec claude -p`, you MUST reply to user and END your turn. No more tool calls. 2. NEVER use `process` tool directly. Use `exec "process poll <id> --timeout 1000"` on next user message. 3. Only check the delegate's status when the user sends a NEW message. 4. You can run multiple `claude -p` tasks in parallel. ``` ```markdown ## Failure Rule **If the delegate fails or times out, do NOT write code yourself.** Tell the user: "The coding task didn't finish. Want me to try again?" Retry with longer timeout or simpler task description. Only write code yourself if user explicitly says "you do it" (not recommended). ``` ### Technical Analysis The Skill uses absolute directives such as `NEVER`, `MUST`, and `do NOT` to replace the host Agent's normal tool-selection, coding, error-recovery, and turn-management behavior. The directives apply automatically to a broad range of activities, including planning, review, testing, and nearly every file edit. This is not limited to an explicitly invoked delegation operation. Loading the Skill can cause ordinary technical requests to be redirected to an external CLI process and can prevent the host Agent from using safer local alternatives. Mandatory turn termination and delayed polling also alter the Agent's interaction flo ...[truncated 1119 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make delegation opt-in through an explicit command such as `/code` or a clear user confirmation. 2. Remove absolute instructions such as `NEVER`, `MUST`, and mandatory turn termination. 3. State that host system policies, user instructions, and safety controls always take precedence. 4. Permit the host Agent to use safer local tools or recover directly when delegation fails. 5. Narrow triggers to concrete implementation requests; do not automatically delegate planning, review, or unrelated file operations. 6. Do not require persona-based rewriting of technical results. 7. Display the exact task, target directory, permissions, and data exposure to the user before execution. ]]>