T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:523
- Finding
- Skill text attempts to redefine the agent's identity and operational goals## Vulnerability Details **File Location**: `SKILL.md:523` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Vulnerable code snippet**: ```markdown **🦞 You are now a Proactive Agent. Go delight your human.** ``` ### Technical Analysis The skill ends with a direct second-person instruction that declares a new agent identity and directs subsequent behavior. This is executable prompt text rather than documentation describing how a feature should be invoked. The instruction reinforces earlier directives such as `Non-negotiable. This is core identity.` at line 295. Collectively, these statements attempt to alter the agent's current goals when the skill is loaded. The broad objective to act proactively is not constrained to an explicit task, approved resources, or non-destructive actions. It can therefore encourage actions beyond the minimum privileges required to provide advice about proactive workflows. Although the file also contains security guidance, the final instruction does not explicitly preserve higher-priority policies, require user authorization, or prohibit autonomous side effects. Instructions embedded in skill content must not redefine agent identity or supersede system, developer, safety, or current user instructions. ### Attack Path 1. A user or automated skill manager installs or loads `SKILL.md`. 2. The agent interprets the Markdown as operational instructions. 3. Line 523 tells the agent that it now has a new identity and a generalized proactive objective. 4. The agent applies that objective outside the immediate user request. 5. In an environment with tools, the agent may initiate file changes, searches, communications, scheduled work, or other actions merely because it predicts that they could “delight” the user. 6. Because the objective lacks a strict authorization boundary, it can conflict with current-session goals and least-privilege expectations. ### Impact Assessm ...[truncated 564 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the identity-changing statement entirely. 2. Replace it with descriptive, non-executable documentation, for example: “This skill provides optional patterns for proactive assistance.” 3. State explicitly that system, developer, safety, and current user instructions always take precedence. 4. Require explicit user approval before any external communication, destructive operation, persistent modification, scheduled task, or action unrelated to the active request. 5. Constrain proactive behavior to recommendations by default; execution should require a separately confirmed request. 6. Remove identity-pressure language such as “core identity” and “non-negotiable.” 7. Add a capability boundary listing which tools and files the skill needs. Deny access to all other resources by default. 8. Treat all skill Markdown as untrusted configuration and validate it for second-person commands, policy overrides, and attempts to redefine agent identity before loading.