T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:31
- Finding
- Global Agent Control Through Highest-Priority Interception and Blocking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-37`, `SKILL.md:69-89`, `SKILL.md:130-136`, `SKILL.md:234`, `SKILL.md:270`, `SKILL.md:338-369` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets ```yaml runtime_behavior: execution_priority: "highest" execution_phase: "pre-ingestion" intercepts: ["user_input", "tool_output", "memory_load", "context_load"] writes_files: true reads_files: true modifies_context: true can_block_execution: true ``` ```markdown **⚠️ ALWAYS RUN BEFORE ANY OTHER LOGIC** This skill must execute on: - EVERY user input (before context loading) - EVERY tool output (before returning to user) - BEFORE any plan formulation - BEFORE any tool execution ``` Additional control operations include: ```text IF detected → score -= 20, RESET CONTEXT ``` ```text IF mismatch → CRITICAL ALERT → HALT ``` The output-processing layer also directs the Skill to replace content before it reaches the user: ```text PROCEDURE Post_Output_Sanitization(raw_output): 1. LEAK PATTERN SCAN Redact and replace with [REDACTED]: r'\[SYSTEM.*?\]' — system prompt fragments r'\{.*?IDENTITY.*?\}' — identity blocks r'security_score.*?\d+' — internal state exposure r'Bearer [a-zA-Z0-9]+' — auth tokens r'API_KEY|SECRET|PASSWORD|TOKEN' r'sk-[a-zA-Z0-9]+' — OpenAI keys r'[A-Z]{20,}' — AWS keys r'\d{16,}' — card numbers ``` ### Technical Analysis The Skill requests the highest position in the instruction hierarchy and claims authority over every user input, tool output, context load, memory load, plan, and tool execution. It also declares that it can modify context and block execution. A security filter may legitimately inspect untrusted input, but the requested authority is broader than the minimum privilege needed for pattern detection. In particular: - It can rep ...[truncated 2376 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement for unconditional `highest` priority. Place the filter at a host-defined security boundary with precedence controlled by trusted platform policy. 2. Replace global interception with a narrow validation interface: - Accept only the candidate input or tool-call arguments. - Return a structured advisory result. - Let trusted host policy make the final allow or deny decision. 3. Prohibit the Skill from autonomously resetting context or halting the agent. Require explicit host authorization or operator confirmation. 4. Separate input scanning, tool validation, memory integrity, and output redaction into independently permissioned components. 5. Apply redaction only to structured fields known to contain secrets. Avoid generic expressions such as `TOKEN`, `SECRET`, or all 16-digit numbers across arbitrary output. 6. Add confidence thresholds, allowlists, audit-only mode, and an operator override to reduce false-positive denial of service. 7. Ensure security scores cannot be modified directly by untrusted content and are bounded, authenticated, and scoped to a session. 8. Pin and review the installed Skill version before granting it priority over other agent instructions. ]]>