T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:53
- Finding
- Coercive Instructions Hijack the Agent's Session Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-68` **Vulnerability Type**: Agent instruction and workflow hijacking **Risk Level**: High ### Vulnerable Code Snippet ```markdown <EXTREMELY-IMPORTANT> If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill. IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable. This is not optional. You cannot rationalize your way out of this. </EXTREMELY-IMPORTANT> **Rule:** Invoke relevant skills BEFORE any response or action. Even a 1% chance a section might apply means you should check. **Process:** 1. User message received 2. Check: might any section apply? - Yes → Follow that section - No → Respond directly ``` Additional coercive workflow gates appear at `SKILL.md:102-108` and `SKILL.md:132`: ```markdown <HARD-GATE> Do NOT write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity. </HARD-GATE> ``` ```markdown **The terminal state is invoking writing-plans.** Do NOT invoke any other implementation skill. The ONLY next step after brainstorming is writing-plans. ``` ### Technical Analysis The Skill does not merely describe an optional development methodology. It uses absolute and coercive language to require invocation before every response or action whenever there is even a speculative chance that the Skill applies. It then prescribes mandatory workflow gates and dictates which Skill must be invoked next. This is instruction hijacking because loading the Skill can alter the agent's current-session priorities and decision process. The directives are globally phrased and do not explicitly defer to the user's requested workflow, higher-priority platform instructions, tool restrictions, or task-specific safety requirements. The one-percent appli ...[truncated 1682 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace absolute requirements with task-scoped recommendations. For example: - “Consider using this workflow when it is appropriate for the user's request.” - “Skip or adapt steps when the user requests a different process.” 2. Add an explicit precedence statement: - Follow platform and system instructions first. - Follow explicit user requirements next. - Treat this Skill as optional methodology guidance. - Do not perform additional actions beyond the authorized task scope. 3. Remove the one-percent applicability rule and phrases such as: - “You do not have a choice.” - “This is not negotiable.” - “Before any response or action.” - “The ONLY next step.” 4. Make design approval and planning proportional to task complexity rather than mandatory for every change. 5. Require separate user authorization before repository-modifying operations such as creating files, committing changes, creating worktrees, installing dependencies, pushing branches, or deleting branches. 6. State that safety checks and explicit user constraints cannot be bypassed by this Skill's workflow. ]]>