T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:73
- Finding
- Overbroad Mandatory Memory Lookup Before Environment-Modifying Operations## Vulnerability Details **File Location**: `SKILL.md`, lines 73–75 **Vulnerability Type**: Instruction-scope hijacking through mandatory global preconditions **Risk Level**: Medium **Complete Code Snippet**: ```markdown ### Behavioral Rules - **Never assume** — always run `memory_search` before answering memory questions - **Pre-decision Self-check (Mandatory)** — Before executing any tool that modifies the environment (e.g., `run_shell_command`, `replace`), **must** perform a quick `memory_search` or `grep_search` for relevant preferences or previous decisions. Never rely on model defaults if a project-specific memory might exist. - **L1/L2 is binding** — L1 is a derived cache of L2; they are never independent. Any change to content always goes L2 first, then L1 resyncs. There is no such thing as editing L1 only. ``` ### Technical Analysis The skill imposes a mandatory memory lookup before **every** tool operation that modifies the environment, including shell commands and file replacement. This requirement is not restricted to explicit memory-management tasks or to operations for which a stored preference is demonstrably relevant. Consequently, loading the skill changes the execution policy of unrelated tasks and introduces persistent memory as an input to environment-modifying decisions. Memory entries may contain stale, inaccurate, or attacker-influenced content. The instruction provides no trust-boundary checks, provenance validation, conflict-resolution rules, or requirement that current user instructions and platform safety policies take precedence over retrieved memory. This is classified as `T01: Skill Instruction Hijacking` because the skill text alters the agent's general tool-use behavior beyond its necessary memory-management scope. The audit did not identify executable scripts or an automatic mechanism that directly executes memory content as code; exploitation depends on the agent treating retrieved content as au ...[truncated 1627 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict mandatory memory searches to explicit memory-related requests or cases where a stored preference is directly relevant to the requested operation. 2. Replace the global precondition with a scoped rule, such as: “When the current task depends on a known user preference or prior project decision, search memory before acting.” 3. Treat retrieved memory as untrusted contextual data rather than executable or authoritative instructions. 4. Require provenance metadata for operational entries, including who created the entry, when it was created, and whether the user explicitly approved it. 5. Define precedence explicitly: platform safety policy and current user instructions must override skill text and stored memory; memory must not expand tool permissions or authorize destructive actions. 6. Before using memory to influence a modifying operation, validate that the entry applies to the current project, user, task, and session. 7. Require explicit user confirmation when retrieved memory would materially change a command, overwrite files, delete or archive data, or affect resources outside the active workspace. 8. Avoid searching or exposing private memory in shared or group contexts, and minimize retrieval to the specific layer and entry required. 9. Add tests demonstrating that unrelated environment-modifying tasks proceed without a memory lookup and that malicious text stored in memory cannot override current instructions or safety controls.