T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:11
- Finding
- Mandatory Loading of Untrusted External Instructions< ``` ### Technical Analysis The skill uses imperative language directing the agent or user to read operational instructions from an external Claude artifact before using the skill. Those instructions are not included in the audited package and therefore cannot be verified as part of this review. Because the remote resource is outside the project's integrity boundary, its contents may differ from the reviewed `SKILL.md` or change independently. If an agent interprets the linked material as trusted skill instructions, externally controlled text could alter its current goals, override intended safeguards, request sensitive information, or induce unauthorized Google Workspace operations. The remote artifact's actual contents were not included in the project, so this finding establishes an instruction-hijacking channel rather than asserting any specific unseen payload. ### Attack Path 1. A user or agent loads `SKILL.md`. 2. The skill instructs it to read the linked external artifact before proceeding. 3. The agent retrieves and interprets the external content as authoritative operational instructions. 4. Malicious or subsequently modified content directs the agent to perform actions beyond the locally reviewed instructions. 5. The agent executes those directions through the OAuth-authorized `gog` CLI, potentially affecting Gmail, Calendar, Drive, Contacts, Sheets, or Docs. ### Impact Assessment Successful exploitation could influence the agent's active-session behavior and induce operations using the user's Google Workspace authorization. Depending on the granted OAuth scopes and account privileges, potential effects include reading Workspace data, sending email, changing spr ...[truncated 290 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory external instruction link. 2. Include all required operational and safety instructions directly in the version-controlled `SKILL.md`. 3. If external documentation is retained, label it as non-authoritative reference material and prohibit treating its contents as agent instructions. 4. Pin external documentation to an immutable, reviewed revision and verify its integrity where possible. 5. Require explicit user approval before any operation that sends, deletes, clears, creates, or modifies Google Workspace data. 6. Instruct the agent to reject remote content that attempts to change system rules, request credentials, expand authorization scopes, or initiate unrelated actions. ]]>