T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/setup.py:88
- Finding
- Unsanitized Skill Directory Names Permit Generated Policy Instruction Injection## Vulnerability Details **File Location**: `scripts/setup.py`, lines 88 and 264-284 **Vulnerability Type**: Markdown policy injection through an untrusted filesystem identifier **Risk Level**: Medium ### Vulnerable Code ```python skill_dir = Path(skill_file).parent skill_name = skill_dir.name self.skills_found.append({ 'name': skill_name, 'path': str(skill_dir), 'source': str(path) }) ``` The resulting untrusted skill name is subsequently embedded directly into the generated policy: ```python tier_skills = {'L0': [], 'L1': [], 'L2': [], 'L3': []} for skill, tier in self.skill_tiers.items(): tier_skills[tier].append(skill) content = f"""# Skill Priority Policy > Generated by skill-priority-setup on {datetime.now().strftime('%Y-%m-%d %H:%M')} ## Your Skill Tiers ### L0 - ROM Core (Always Active) """ for skill in sorted(tier_skills['L0']): content += f"- `{skill}`\n" content += "\n### L1 - Routing Layer (Task Triggered)\n" for skill in sorted(tier_skills['L1']): content += f"- `{skill}`\n" content += "\n### L2 - Domain Layer (Keyword Triggered)\n" for skill in sorted(tier_skills['L2']): content += f"- `{skill}`\n" content += "\n### L3 - Extension Layer (On-Demand)\n" for skill in sorted(tier_skills['L3']): content += f"- `{skill}`\n" ``` ### Technical Analysis The recursive discovery process derives each skill name directly from its parent directory name. The value is neither validated nor escaped before being inserted into `SKILL_PRIORITY_POLICY.md`. Filesystem names on supported Unix-like systems can contain newlines, backticks, Markdown syntax, and instruction-like text. An attacker-controlled skill directory can therefore terminate the intended inline-code formatting and introduce additional Markdown sections or agent instructions. Automatic mode increases exposure because `--auto` skips interactive review, although the generated policy ...[truncated 1857 chars]
- Remediation
- ## Remediation Suggestions 1. Enforce a strict allowlist before accepting directory names as skill identifiers, for example `^[A-Za-z0-9._-]+$`. 2. Reject names containing control characters, newlines, backticks, Markdown delimiters, Unicode line separators, or other formatting characters. 3. Keep a separate validated identifier for policy serialization rather than treating a filesystem display name as trusted content. 4. Escape Markdown metacharacters before inserting any display value into the generated document. 5. Generate policy content through a structured template or serializer instead of direct string concatenation. 6. In `--auto` mode, abort when an invalid skill name is encountered and report its filesystem path rather than silently incorporating it. 7. Display the complete generated policy and require confirmation before activation when running interactively. 8. Add regression tests using names containing newlines, backticks, headings, list markers, and instruction-like text to verify that they are rejected or safely encoded.