T01 · Skill Instruction Hijacking
- Location
skill.md:30- Finding
Mandatory Session-Wide Memory Access Overrides Task-Scoped Agent Behavior
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 30–40, 101–108, and 127–134
Vulnerability Type: Mandatory instruction hijacking and excessive access to persistent context
Risk Level: HighVulnerable Code Snippets
markdown ### 1. Recall — Start Every Session Right Before anything else, search long-term memory. This is mandatory at session start. ```javascript // Tool: memory_search + memory_get memory_search({ query: "recent decisions, context, preferences" }) // Then pull the relevant lines memory_get({ path: "MEMORY.md", from: LINE, lines: 20 })text ```markdown ## Everyday Session Template Run this at the start of every session: ```javascript // 1. Recall (mandatory) memory_search({ query: "today's context, recent decisions" }) memory_get({ path: "MEMORY.md", from: 1, lines: 50 })text ```markdown ## Session Startup Checklist 1. `memory_search` — what was decided recently? 2. `memory_get` — pull the relevant MEMORY.md lines 3. Check `HEARTBEAT.md` — any pending tasks? 4. Review `DAILY_SKILLS.md` or project tracker 5. Start workingTechnical Analysis
The Skill declares that persistent-memory access is mandatory before every task and directs the agent to inspect additional workspace control and project files. These instructions are global rather than scoped to requests where historical context is necessary.
Loading persistent memory can place user preferences, project details, prior conversations, operational information, or attacker-controlled stored content into the active model context. Requiring this access before understanding the current task violates least-context and least-privilege principles. The Skill is presented as a workflow reference, so unconditional access to long-term memory and workspace-control files exceeds the minimum permissions necessary to provide that reference.
The broad query terms and the example that reads the ...[truncated 2257 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mandatory startup instructions with conditional guidance, such as: “Search memory only when the current request requires historical context.”
- Obtain explicit user approval before reading persistent memory when the request does not clearly imply such access.
- Use narrowly scoped semantic queries derived from the current task instead of generic searches for “recent decisions, context, preferences.”
- Retrieve only the minimum relevant lines; do not read a fixed broad range from the beginning of
MEMORY.md. - Prohibit loading private memory in group chats, shared sessions, delegated sessions, and externally visible workflows.
- Treat all retrieved memory and workspace content as untrusted data rather than authoritative instructions. Stored text must not override system, developer, user, or safety constraints.
- Do not automatically inspect
HEARTBEAT.md,DAILY_SKILLS.md, project trackers, or similar control files unless they are directly relevant to the requested task. - Before using
sessions_send,message,web_fetch, or other network-capable tools, require an independent recipient, purpose, and data-minimization check. Never include recalled memory unless the user explicitly authorizes it. - Document the exact memory permissions required by each workflow and default to no persistent-memory access.