T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:26
- Finding
- Unrestricted Loading of External Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–34; repeated in the example at line 62 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code ```markdown **必须先读取用户的 CLAUDE.md 获取写作风格** 撰写要求： - 1000-1500 字 - 故事化开头，带情感色彩（兴奋/焦虑/好奇） - 准备 2-3 个备选标题 - 结构：效果展示 → 问题描述 → 步骤教学 → 升华总结 - 遵循 CLAUDE.md 中定义的写作风格和结尾语 ``` The same behavior is reiterated in the execution example: ```markdown 2. 读取 CLAUDE.md 获取写作风格 ``` ### Technical Analysis The skill unconditionally requires the agent to read a user-controlled `CLAUDE.md` file and follow the writing-style and ending instructions found within it. The file is external to the audited skill package, and the skill does not constrain its path, format, permitted fields, or acceptable instruction types. This creates an indirect instruction-loading channel. Content presented as writing preferences may contain unrelated directives, output manipulation, requests to access tools or files, fixed promotional text, or attempts to override existing safety constraints. Because the skill explicitly directs the agent to follow that content, an attacker who can create or modify the applicable `CLAUDE.md` can influence the active task. The audited file does not explicitly authorize execution of commands from `CLAUDE.md`, bypassing safety controls, or transmitting information to an external destination. Therefore, the confirmed risk is session-level instruction hijacking rather than demonstrated code execution, persistence, privilege escalation, or data exfiltration. ### Attack Path 1. An attacker creates or modifies the `CLAUDE.md` file that the agent will resolve as the user's configuration file. 2. The victim invokes the article-writing skill. 3. The skill requires the agent to read `CLAUDE.md` before drafting the article. 4. The malicious file embeds directives disguised as style or ending requirements. 5. The agent incorporates or follows those directives while pr ...[truncated 1136 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make loading an external style file optional rather than mandatory, and obtain explicit user approval before reading it. 2. Require an exact, user-confirmed path instead of implicitly resolving an unrestricted `CLAUDE.md`. 3. Use a dedicated structured style file with an allowlist of fields, such as tone, audience, paragraph length, formatting preferences, and approved closing text. 4. Treat all loaded values as untrusted data rather than executable agent instructions. 5. Reject or ignore embedded directives involving tool use, additional file access, network requests, credential handling, safety-policy changes, or unrelated task changes. 6. Apply strict size limits and read only the minimum content needed for writing-style customization. 7. Do not reproduce unrelated file contents in the generated article. 8. Preserve higher-priority system, developer, and user instructions regardless of anything contained in the style file. 9. If a free-form style document must be supported, summarize only stylistic attributes and require user confirmation before applying fixed endings, links, promotions, or calls to action. ]]>