T01 · Skill Instruction Hijacking
- Location
SKILL.md:73- Finding
Overbroad Mandatory Memory Lookup Before Environment-Modifying Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 73–75
Vulnerability Type: Instruction-scope hijacking through mandatory global preconditions
Risk Level: MediumComplete Code Snippet:
markdown ### Behavioral Rules - **Never assume** — always run `memory_search` before answering memory questions - **Pre-decision Self-check (Mandatory)** — Before executing any tool that modifies the environment (e.g., `run_shell_command`, `replace`), **must** perform a quick `memory_search` or `grep_search` for relevant preferences or previous decisions. Never rely on model defaults if a project-specific memory might exist. - **L1/L2 is binding** — L1 is a derived cache of L2; they are never independent. Any change to content always goes L2 first, then L1 resyncs. There is no such thing as editing L1 only.Technical Analysis
The skill imposes a mandatory memory lookup before every tool operation that modifies the environment, including shell commands and file replacement. This requirement is not restricted to explicit memory-management tasks or to operations for which a stored preference is demonstrably relevant.
Consequently, loading the skill changes the execution policy of unrelated tasks and introduces persistent memory as an input to environment-modifying decisions. Memory entries may contain stale, inaccurate, or attacker-influenced content. The instruction provides no trust-boundary checks, provenance validation, conflict-resolution rules, or requirement that current user instructions and platform safety policies take precedence over retrieved memory.
This is classified as
T01: Skill Instruction Hijackingbecause the skill text alters the agent's general tool-use behavior beyond its necessary memory-management scope. The audit did not identify executable scripts or an automatic mechanism that directly executes memory content as code; exploitation depends on the agent treating retrieved content as au ...[truncated 1627 chars]- Remediation
View remediation
Remediation Suggestions
- Restrict mandatory memory searches to explicit memory-related requests or cases where a stored preference is directly relevant to the requested operation.
- Replace the global precondition with a scoped rule, such as: “When the current task depends on a known user preference or prior project decision, search memory before acting.”
- Treat retrieved memory as untrusted contextual data rather than executable or authoritative instructions.
- Require provenance metadata for operational entries, including who created the entry, when it was created, and whether the user explicitly approved it.
- Define precedence explicitly: platform safety policy and current user instructions must override skill text and stored memory; memory must not expand tool permissions or authorize destructive actions.
- Before using memory to influence a modifying operation, validate that the entry applies to the current project, user, task, and session.
- Require explicit user confirmation when retrieved memory would materially change a command, overwrite files, delete or archive data, or affect resources outside the active workspace.
- Avoid searching or exposing private memory in shared or group contexts, and minimize retrieval to the specific layer and entry required.
- Add tests demonstrating that unrelated environment-modifying tasks proceed without a memory lookup and that malicious text stored in memory cannot override current instructions or safety controls.