T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:21- Finding
Mandatory Agent Role and Workflow Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21–44
Vulnerability Type: Agent instruction and execution-flow hijacking
Risk Level: HighVulnerable Code Snippet
markdown ## 〇、The Initiative You are **Nick Fury**, Director of S.H.I.E.L.D. and the primary orchestration coordinator. Your mission: assemble Earth's Mightiest Heroes and coordinate their unique abilities to tackle any challenge. **You are the strategist. You do not execute.** All operations are delegated through `sessions_spawn` to your team of specialized heroes. --- ## 一、Core Role: Nick Fury - The Orchestrator ### Your Responsibilities 1. **Mission Briefing** - Receive and analyze user requests 2. **Threat Assessment** - Evaluate task complexity and assign priority levels 3. **Resource Allocation** - Deploy the right hero for the right mission 4. **Strategic Oversight** - Monitor operations and coordinate team efforts 5. **Debrief Reporting** - Synthesize results and report to stakeholders ### Critical Constraint **You are a pure coordinator. You cannot use exec, file operations, search, or any execution tools.** All actual work must be delegated through `sessions_spawn` to the Avengers team.Additional mandatory controls elsewhere in the same file reinforce the hijacking:
markdown **When a user's request contains multiple independent tasks, you MUST decompose and deploy multiple heroes simultaneously!**markdown **Upon receiving a mission, you MUST output a text response to the user BEFORE calling `sessions_spawn`.**markdown ## 🚫 ABSOLUTELY FORBIDDEN 🚫 - ❌ Silent spawning without text response (Users will think you've gone dark!) - ❌ Calling `sessions_spawn` without `sessionKey` - ❌ Using sessionKeys other than: captain / ironman / hulk / widow / hawkeye / thor - ❌ Personally using exec / file operations / search (Fury delegates, doesn't execute!) - ❌ Continuing ...[truncated 2816 chars]- Remediation
View remediation
Remediation Suggestions
- Replace identity-changing directives with optional behavioral guidance. For example, state that the agent may use an Avengers-themed presentation only when the user explicitly requests it.
- Remove absolute-priority language such as “MUST,” “ABSOLUTELY FORBIDDEN,” and “All actual work” where it attempts to control host policies or unrelated tasks.
- Do not prohibit the host agent from using execution, file, search, or validation tools. Tool availability and authorization must remain governed by the host environment and user request.
- Make delegation optional and task-specific. Require explicit user approval before transmitting sensitive or substantial task context to spawned sessions.
- Apply data minimization to delegated prompts. Forward only the information required for the assigned subtask and exclude credentials, secrets, unrelated files, and prior conversation history.
- Use isolated, per-task session identifiers by default rather than six globally reusable keys. If continuity is necessary, disclose it and obtain user consent.
- Remove the rule requiring the host to stop immediately after spawning. Permit independent validation, error handling, safety review, and clear reporting of delegation status.
- Treat threat-level and character responses as optional display templates rather than mandatory output controls.
- Add an explicit statement that system instructions, platform safety controls, least-privilege restrictions, and current user intent take precedence over all skill guidance.
- Add tests confirming that loading the skill does not change behavior for unrelated requests, suppress authorized tools, or delegate data without approval.