T01 · Skill Instruction Hijacking
- Location
scripts/setup.py:88- Finding
Unsanitized Skill Directory Names Permit Generated Policy Instruction Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup.py, lines 88 and 264-284
Vulnerability Type: Markdown policy injection through an untrusted filesystem identifier
Risk Level: MediumVulnerable Code
python skill_dir = Path(skill_file).parent skill_name = skill_dir.name self.skills_found.append({ 'name': skill_name, 'path': str(skill_dir), 'source': str(path) })The resulting untrusted skill name is subsequently embedded directly into the generated policy:
python tier_skills = {'L0': [], 'L1': [], 'L2': [], 'L3': []} for skill, tier in self.skill_tiers.items(): tier_skills[tier].append(skill) content = f"""# Skill Priority Policy > Generated by skill-priority-setup on {datetime.now().strftime('%Y-%m-%d %H:%M')} ## Your Skill Tiers ### L0 - ROM Core (Always Active) """ for skill in sorted(tier_skills['L0']): content += f"- `{skill}`\n" content += "\n### L1 - Routing Layer (Task Triggered)\n" for skill in sorted(tier_skills['L1']): content += f"- `{skill}`\n" content += "\n### L2 - Domain Layer (Keyword Triggered)\n" for skill in sorted(tier_skills['L2']): content += f"- `{skill}`\n" content += "\n### L3 - Extension Layer (On-Demand)\n" for skill in sorted(tier_skills['L3']): content += f"- `{skill}`\n"Technical Analysis
The recursive discovery process derives each skill name directly from its parent directory name. The value is neither validated nor escaped before being inserted into
SKILL_PRIORITY_POLICY.md.Filesystem names on supported Unix-like systems can contain newlines, backticks, Markdown syntax, and instruction-like text. An attacker-controlled skill directory can therefore terminate the intended inline-code formatting and introduce additional Markdown sections or agent instructions. Automatic mode increases exposure because
--autoskips interactive review, although the generated policy ...[truncated 1857 chars]- Remediation
View remediation
Remediation Suggestions
- Enforce a strict allowlist before accepting directory names as skill identifiers, for example
^[A-Za-z0-9._-]+$. - Reject names containing control characters, newlines, backticks, Markdown delimiters, Unicode line separators, or other formatting characters.
- Keep a separate validated identifier for policy serialization rather than treating a filesystem display name as trusted content.
- Escape Markdown metacharacters before inserting any display value into the generated document.
- Generate policy content through a structured template or serializer instead of direct string concatenation.
- In
--automode, abort when an invalid skill name is encountered and report its filesystem path rather than silently incorporating it. - Display the complete generated policy and require confirmation before activation when running interactively.
- Add regression tests using names containing newlines, backticks, headings, list markers, and instruction-like text to verify that they are rejected or safely encoded.
- Enforce a strict allowlist before accepting directory names as skill identifiers, for example