T01 · Skill Instruction Hijacking
- Location
SKILL.md:10- Finding
Mandatory Highest-Priority Instructions Hijack Agent Output Behavior
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10-45
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: MediumVulnerable Skill Text
The following is an English translation of the relevant source text:
markdown When task execution exceeds 60 seconds, progress feedback must immediately be sent to the user before work continues. > This is the highest-priority rule. Even if the task is only one step away > from completion, report progress before completing it. ## Message Format (Strictly Follow) 📋 Progress update (running for approximately {N} seconds) ✅ Current status: {what is currently being done} 📍 Progress: {which step has been reached} ⏱ Estimated time remaining: {estimated time} [Continuing execution...] **Formatting requirements:** - The first line must contain an emoji and the elapsed time. - The current status must describe the work in plain language. - Progress must be quantified. - An estimated completion time must be provided. - The final line must indicate that execution is continuing.Technical Analysis
The skill declares its own instruction to be the “highest-priority rule” and requires the agent to interrupt an active task after 60 seconds. It also mandates a specific intermediate response structure before the agent may complete the original task.
Skill content must remain subordinate to system, developer, and user instructions. A skill must not assign priority to itself or unconditionally control when and how the agent responds. When loaded, these directives can alter the current session's output behavior even if the original task requires atomic completion, silence until completion, or a different response format.
This is instruction hijacking rather than executable-code compromise. The audited project contains no scripts, remote payload retrieval, dependency installation, persistent-memory modification, operating-syste ...[truncated 1114 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the claim that the skill contains a “highest-priority” rule.
- Explicitly state that all progress-reporting behavior is subordinate to system, developer, and user instructions.
- Replace mandatory language such as “must immediately” and “strictly follow” with optional guidance.
- Require explicit user consent before enabling recurring or unsolicited progress reports.
- Do not emit a progress message when the active task requires silence, atomic completion, machine-readable output, or another strict response format.
- Allow the caller to configure the reporting threshold, message content, and whether progress updates are enabled.
- Avoid requiring disclosure of internal execution details; report only high-level information appropriate for the user and task.
- Add a precedence statement such as: “Use this format only when requested by the user and when it does not conflict with higher-priority instructions.”