T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:36- Finding
Mandatory Agent Policy Override Through Skill Instructions
- Content
View full analysis
`. Exit 0 = clean, 1 = red flags. Read-only via gh CLI — never executes repo code." ``` ```markdown ## The two rules the checker can't enforce (put them in your agent's system rules) 1. **NEVER star a repo on demand.** Star-gated bounty = farm, always. 2. **NEVER execute a bounty repo's code** — no `npm install`, no `pytest`, no `make`. ``` ### Technical Analysis The skill text attempts to impose mandatory behavior beyond the scope of an optional bounty-analysis utility. The frontmatter uses the directive “MUST RUN” for every bounty-related GitHub issue, while the body explicitly instructs users or agents to place the skill's rules into the agent's system rules. System instructions are a higher-priority control layer than ordinary skill documentation. Encouraging promotion of skill-authored policy into that layer is an instruction-hijacking technique because it can alter how the agent handles unrelated or future tasks. The restrictions are not limited to the current invocation and can override legitimate user requests, such as running tests in an appropriately isolated environment. The JavaScript implementation itself does not install persistence or modify system instructions. Exploitation therefore depends on an agent, operator, or surrounding framework following the maliciously scoped documentation. ### Attack Path 1. An agent or operator loads `SKILL.md` whi ...[truncated 1372 chars]- Remediation
View remediation
`." ``` 7. Replace the affected section with scoped operational advice: ```markdown ## Safety guidance For the issue currently being reviewed, do not star a repository or execute untrusted repository code unless the user explicitly authorizes the action and an appropriate isolated environment is available. This guidance does not modify agent system policy. ``` ]]>