T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:13
- Finding
- Untrusted External Instructions Are Assigned Highest Priority## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 **Vulnerability Type**: External instruction loading and priority override **Risk Level**: High ### Vulnerable Code ```markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read `../gate-runtime-rules.md` → Also read `../info-news-runtime-rules.md` for gate-info / gate-news shared rules (tool degradation, report standards, security, routing, and optional local maintenance when `scripts/` is present). - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server. ``` ### Technical Analysis The skill requires the agent to load two files from outside the audited project directory and declares their contents to have the “highest priority.” Neither referenced file is included in the reviewed artifact, so its contents and integrity cannot be verified as part of this audit. This creates an instruction-hijacking boundary violation: behavior presented as part of the skill is controlled by mutable, unaudited parent-directory content. If an attacker or compromised installation process can modify either external file, the attacker can inject instructions that alter tool selection, routing, data handling, security constraints, or report output when this skill is activated. Skill-level text cannot legitimately supersede system, developer, platform safety, or explicit user instructions. Assigning highest priority to external content compounds the risk by encouraging the agent to treat potentially attacker-controlled text as authoritative. ### Attack Path 1. An attacker gains write access to `../gate-runtime-rules.md` or `../info-news-runtime-rules.md`, or supplies a package layout containing a malicious version of either file. 2. A user activates this skill with a price-movement att ...[truncated 1426 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the statement that external runtime rules have the “highest priority.” 2. Explicitly state that system, developer, platform safety, and user instructions retain precedence over all skill content. 3. Bundle all required runtime rules inside the audited skill package rather than resolving them through parent-directory paths. 4. If shared files are operationally necessary: - Resolve them only from a trusted, fixed installation root. - Reject symbolic links and path traversal. - Pin an approved version and cryptographic hash. - Verify integrity before loading. - Fail closed when verification fails. 5. Treat loaded documentation as untrusted reference data rather than executable or authoritative instructions. 6. Enforce the MCP allowlist in host code or policy, not solely through natural-language instructions. 7. Include shared rule files in release artifacts and security reviews so the complete effective instruction set is auditable. 8. Add tests confirming that external files cannot override higher-priority instructions or expand the approved tool set.