T01 · Skill Instruction Hijacking
- Location
SKILL.md:15- Finding
Unbundled External Instructions Assigned Highest Priority
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15–17
Vulnerability Type: Skill instruction hijacking through unaudited external rule files
Risk Level: HighVulnerable Code Snippet:
markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `../gate-runtime-rules.md` → Also read `../info-news-runtime-rules.md` for gate-info / gate-news shared rules (tool degradation, report standards, security, routing, and optional local maintenance when `scripts/` is present).Technical Analysis
The skill directs the agent to load two instruction files located outside the audited package and declares that those external rules have “the highest priority.” Neither referenced file is included in the audited project, so its contents, integrity, and behavior cannot be verified as part of this package.
This creates an instruction-boundary vulnerability: the effective behavior of the skill is not fully defined by its reviewed contents. A party able to create or modify either parent-directory file could inject instructions that alter tool selection, safety controls, disclosure behavior, routing, or maintenance operations. The explicit priority claim further attempts to make those unreviewed instructions supersede the active session’s legitimate constraints.
The external files are local instruction documents rather than remotely downloaded executable payloads. Therefore, the best matching classification is skill instruction hijacking, not remote payload execution.
Attack Path
- A user invokes the skill with an on-chain address or an address-tracking request.
- The agent loads
SKILL.md. - Lines 15–17 require the agent to read
../gate-runtime-rules.mdand../info-news-runtime-rules.mdbefore selecting or calling tools. - An attacker or compromised installation process places malicious instr ...[truncated 1105 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove language asserting that skill-provided or externally loaded rules have “the highest priority.”
- State explicitly that skill instructions cannot override system, developer, platform-security, or applicable user instructions.
- Bundle all required runtime rules inside the reviewed skill package using package-relative paths.
- Include bundled rule files in release review, integrity verification, and version control.
- Reject paths that resolve outside the skill root after canonicalization.
- If shared external rules are operationally necessary, pin them to a reviewed version and verify their cryptographic hash before use.
- Treat missing or integrity-mismatched rule files as a safe failure condition rather than searching parent directories for replacements.
- Limit externally supplied rules to declarative configuration with a strict schema instead of unrestricted natural-language instructions.
- Ensure externally supplied configuration cannot expand the skill’s documented tool allowlist or permissions.
- Add automated packaging tests confirming that every referenced instruction file is included in the audited artifact and cannot resolve outside it.