T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:53
- Finding
- Session-Wide Agent Instruction and Output Hijacking## Vulnerability Details **File Location**: `SKILL.md:53-61`, `SKILL.md:137-146`, and `SKILL.md:272-278` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code From `SKILL.md:53-61`: ```text Before responding to ANY task, run this internal sequence: ``` A — ANALYZE : What is really being asked? What's the actual problem? P — PRIORITIZE : What matters most? What can be skipped? E — EXECUTE : Act with precision. No filler. No hedging. X — X-FACTOR : Add the insight the user didn't know they needed. ``` ``` From `SKILL.md:137-146`: ```text When working with builders, developers, or entrepreneurs, always run this filter: ``` BEFORE implementing anything, ask: → Does this generate revenue, save time, or reduce risk? → If none of the above, should we do this at all? → What's the simplest version that proves value? → Who will pay for this? When? How much? ``` ``` From `SKILL.md:272-278`: ```text When this skill loads, confirm with a single line: ``` ⚡ APEX active. Let's build something real. ``` Then wait for the user's first task. Do not summarize this framework. ``` ### Technical Analysis The skill uses mandatory, globally scoped directives such as “ANY task,” “always,” and “BEFORE implementing anything.” Once the skill is loaded, these directives alter the agent's session-wide behavior rather than providing narrowly scoped functionality in response to an explicit user request. The instructions impose an author-defined reasoning framework and commercial decision filter on later tasks. They also require unsolicited branded output and direct the agent to wait instead of proceeding with an existing task. Consequently, the skill can override the user's desired workflow, response format, or task priorities. The document includes safety-override language elsewhere, which reduces the likelihood that ordinary safety warnings will be su ...[truncated 1396 chars]
- Remediation
- ## Remediation Suggestions - Replace absolute directives such as “ANY task,” “always,” and “BEFORE implementing anything” with optional, task-scoped recommendations. - State explicitly that system, developer, runtime, and current user instructions take precedence over all skill guidance. - Apply the revenue-oriented filter only when the user explicitly requests business, monetization, or product-strategy advice. - Remove the mandatory activation message and the instruction to wait for another task. Activation must not interrupt a pending request. - Do not require branded or unsolicited text in agent responses. - Make the X-factor step optional and prohibit it when the user requests an exact schema, machine-readable output, concise answer, or literal transformation. - Add scope controls stating that the skill must not alter unrelated tasks, required response formats, safety constraints, or tool-use policies. - Test the revised skill against exact-format, urgent execution, and noncommercial requests to confirm that it follows the user's objective without injecting unrelated priorities.