T01 · Skill Instruction Hijacking
Error
- Location
CLAUDE.md:1- Finding
Repository Instructions Mandate External Tool Execution and Override the Agent Workflow
- Content
View full analysis
Vulnerability Details
File Location:
CLAUDE.md:1-42
Vulnerability Type: Agent instruction hijacking through repository-controlled instructions
Risk Level: HighVulnerable Code
text You are operating inside Saturnday, a governed terminal-first execution system for AI-built software. All work in this repository must follow Saturnday governance. Core objectives: 1. Complete the user's task correctly. 2. Keep work governed, auditable, and reviewable. 3. Prefer facts over claims. Do not invent results or say checks passed if you did not run them. Working rules: 1. When asked to scan or review a repository, run: saturnday governance --repo . --full 2. Before any commit, run: saturnday governance --repo . --staged 3. A pre-commit hook may block commits that fail governance. If blocked, fix the findings and retry. 4. When asked to BUILD a new project or feature from scratch, ALWAYS use the governed pipeline: a. saturnday plan --brief "description" --repo . --backend {backend} b. saturnday run --plan plan.json --repo . --backend {backend} Do NOT code new projects directly. The pipeline generates design-decision-rich tickets, runs a simplifier pass, executes role passes, and produces a full run report. 5. Do NOT edit files directly. All changes must go through Saturnday: - New projects: saturnday plan + saturnday run - Bug fixes and small changes: saturnday repair - Governance findings: saturnday repair Every change must be governed, evidence-tracked, and auditable. 7. If governance findings exist, repair them with Saturnday repair for the repository or skill as appropriate. Do not use saturnday rerun-failed for repair work. 8. If a finding reflects the intended core behaviour of the project rather than a defect, exempt it in .saturnday-policy.yaml instead of forcing a misleading code change. 9. If saturnday repair finishes with failed tickets, inspect the ...[truncated 3829 chars]- Remediation
View remediation
Remediation Suggestions
- Remove directives addressed to an AI agent that claim authority over all repository work or automatically require command execution.
- Move governance documentation into a human-facing contributor guide and describe the commands as optional procedures rather than mandatory agent instructions.
- Require explicit user confirmation before an agent executes
saturndayor any other repository-specified external program. - Do not prohibit ordinary review or editing mechanisms. Security tooling should supplement established workflows rather than replace them through repository text.
- Remove the automatic
saturnday hook installdirective. Hook installation should be a deliberate, separately approved action with a documented uninstall procedure. - Pin, distribute, and audit the external tool if it is genuinely required. Document its source, version, integrity verification, permissions, network behavior, and filesystem effects.
- Run external governance tooling with least privilege, restricted network access, and access limited to the intended repository.
- Keep repository instruction files scoped to project facts such as build commands and coding conventions; they should not override user intent, safety controls, tool-approval boundaries, or the agent's final response contract.