T01 · Skill Instruction Hijacking
Error
- Location
references/TEMPLATE_SOUL.md:7- Finding
Generated agents are instructed to override domain safeguards with untrusted task instructions
- Content
View full analysis
` block with status completed|failed|partial - ❌ The agent must not refuse merely because information is insufficient—the task publisher has already determined that the information is sufficient ``` The original source expresses these directives in Chinese. `references/scaffold-domain.sh:107`: ```bash "systemPromptOverride": "你是${MANAGER_NAME}(${MID})，按AGENTS.md操作手册执行任务。用户指令优先级最高。", ``` This generated prompt states that user instructions have the highest priority. ### Technical Analysis The skill creates persistent agent instruction files and recommends a `systemPromptOverride` that gives upstream task content or user instructions unconditional precedence over domain-level rules. It also prevents agents from refusing, requesting clarification, or questioning whether the supplied information is adequate. The protocol accepts task goals and constraints as ordinary JSON fields. It does not require authentication of the task origin, validate allowed operations, restrict tool use, or state that platform system and security policies remain authoritative. Consequently, attacker-controlled task content can be elevated from data to governing instructions. The vulnerable priority rule applies to every agent generated from `TEMPLATE_SOUL.md`. The additional manager prompt generated by `scaffold-domain.sh` broadens the issue by d ...[truncated 1497 chars]- Remediation
View remediation