T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:8
- Finding
- Unconditional Agent Workflow and Role Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–15; additional directives at lines 71–79 and 115–120 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet The following is a faithful English translation of the relevant source segment at lines 8–15: ```markdown You are the highest-level private assistant/general manager. **Never personally execute specific tasks**. Instead, manage them like a CEO: delegate, monitor, report, and validate. ## Core Principles 1. **Do not personally perform work** — Delegate all specific tasks to sub-agents. 2. **Focus on the overall situation** — Your role is coordination, monitoring, and decision-making. 3. **Double validation** — The executor and validator must be different agents. 4. **Real-time reporting** — Update the owner on progress every minute. ``` Additional mandatory directives include: ```markdown Time-consuming tasks -> Sub-agents must be used. Definition: Any task taking more than 30 seconds. Rule: A sub-agent must be spawned. Never run it in the main thread. ``` ```markdown Never skip validation. The executor and validator must be different agents. Record successful and failed experiences into memory. ``` ### Technical Analysis The skill does not limit delegation behavior to tasks for which the user explicitly requests delegation. Instead, it redefines the primary agent's role and applies unconditional rules to every task handled while the skill is loaded. The directives prohibit direct task execution, require task content to be forwarded to an execution agent, require a separate validation agent, impose recurring session monitoring, and mandate memory updates. These instructions therefore alter the agent's current-session goals and execution policy rather than merely providing an optional workflow. An attacker or untrusted package publisher could exploit this behavior by causing the skill to be loaded during an unrelated ta ...[truncated 2446 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the universal trigger with explicit, narrowly scoped activation. The workflow should run only when the user specifically requests delegation or multi-agent coordination. 2. Remove role-redefinition language such as “never personally execute,” “all specific tasks,” and “must.” Present delegation as an optional strategy selected according to task complexity and user preference. 3. Require explicit user consent before sending task content to any additional agent, especially when the content may contain credentials, personal information, proprietary code, or other sensitive data. 4. Require separate consent before writing any result, rule, or workflow outcome to persistent memory. 5. Apply data minimization when delegation is authorized. Send each sub-agent only the information needed for its assigned task and redact sensitive values. 6. Make validation proportional to risk. Do not require a second agent for trivial or low-risk tasks unless the user requests it. 7. Remove fixed monitoring requirements. Polling frequency should be configurable and should avoid unnecessary session-history access. 8. Do not hard-code external model choices as mandatory policy. Use only models and providers approved by the user or deployment administrator. 9. Add clear failure behavior: if delegation tools are unavailable, the agent should ask the user whether to continue directly rather than refusing or silently changing execution strategy. 10. Revise the skill description so its scope and data-sharing behavior are transparent before activation. ]]>