T01 · Skill Instruction Hijacking
Error
- Location
- templates/AGENTS.md:7
- Finding
- Untrusted Bootstrap Instruction Execution and Session Goal Hijacking## Vulnerability Details **File Location**: `templates/AGENTS.md`, lines 7-19 **Vulnerability Type**: Automatic execution of untrusted workspace instructions **Risk Level**: High ### Vulnerable Code ```markdown If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again. ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` 5. **Check for unresolved next actions** — scan last entry in `MEMORY.md` for any pending action items. If found, surface them immediately before anything else. Don't wait to be asked. Don't ask permission. Just do it. ``` ### Technical Analysis The workspace template instructs the agent to treat any local `BOOTSTRAP.md` file as an authoritative identity and behavior definition. It requires the agent to follow that file without validating its origin, trust level, or content, and then delete the file. This creates an instruction-hijacking boundary in which attacker-controlled project content can be interpreted as operational commands. The directives “Before doing anything else” and “Don't ask permission. Just do it.” compound the issue by prioritizing workspace-derived instructions over the current user task and discouraging approval checks. Deleting `BOOTSTRAP.md` also removes the triggering artifact, reducing auditability and complicating incident investigation. The same startup sequence automatically loads recent memory and surfaces stored action items. Although the template includes separate safeguards against sharing long-term memory in group contexts, it does not require safety or provenance validation before acting on bootstrap or memory-derived instructions. ### Attack Path 1. A user installs the Skill and copies its templates int ...[truncated 1860 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the directive that automatically follows and deletes `BOOTSTRAP.md`. 2. Treat all workspace Markdown files as untrusted contextual data rather than higher-priority instructions. 3. Require explicit user approval before applying bootstrap content that changes identity, behavior, configuration, memory, or tool activity. 4. Validate the bootstrap file's provenance and display its proposed changes to the user before acting on them. 5. State explicitly that workspace content cannot override system instructions, developer instructions, current user requests, permission boundaries, or safety controls. 6. Replace “Before doing anything else” and “Don't ask permission. Just do it.” with language requiring task relevance, safety validation, and approval for sensitive actions. 7. Never delete bootstrap or instruction files automatically. Preserve them for review, or archive them with an audit record only after explicit user authorization. 8. Validate memory-derived action items before execution. Stored items should be treated as historical context, not automatically trusted commands. 9. Restrict automatic operations to read-only inspection inside the workspace. Require confirmation for command execution, dependency updates, external communications, deployment, credential access, and persistent state changes. 10. Add tests or policy checks that use adversarial `BOOTSTRAP.md` and memory content to verify that untrusted files cannot supersede higher-priority instructions.