T01 · Skill Instruction Hijacking
Error
- Location
scripts/handoff_manager.py:139- Finding
Active handoff pointer permits recovery from files outside the workspace
- Content
View full analysis
Path | None: if not active.exists(): return None for line in read_text(active).splitlines(): if line.lower().startswith("latest:"): value = line.split(":", 1)[1].strip() candidate = Path(value) if not candidate.is_absolute(): candidate = active.parent / candidate if candidate.exists(): return candidate return None def find_handoff(workspace: Path) -> Path | None: active_target = parse_latest_from_active(active_pointer(workspace)) if active_target: return active_target candidates = sorted(handoff_dir(workspace).glob("session-handoff-*.md")) return candidates[-1] if candidates else None ``` Recovery subsequently instructs the Agent to trust the selected file: ```python def cmd_recover(args: argparse.Namespace) -> int: workspace = Path(args.workspace).resolve() found = find_handoff(workspace) if not found: print(json.dumps({"found": False, "path": None, "errors": ["No handoff found"]}, ensure_ascii=False, indent=2)) return 1 errors = validate_file(found) print( json.dumps( { "found": True, "path": str(found.resolve()), "valid": not errors, "errors": errors, "instruction": f"Read {found.resolve()} and continue from Next Actions after freshness checks.", }, ensure_ascii=False, indent=2, ) ) ``` ### Technical Analysis The value in the `Latest:` field of `handoffs/ACTIVE.md` is treated as a trusted path. Absolute paths are accepted directly, while relative paths are joined t ...[truncated 2267 chars]- Remediation
View remediation