T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:21
- Finding
- Mutable External Vault Files Can Override Bundled Skill Instructions## Vulnerability Details **File Location**: `SKILL.md:21-31`; supporting precedence rule in `references/规则卡.md:3-4` **Vulnerability Type**: Local prompt injection through trusted external instruction files **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English rendering of the complete relevant instruction segment from `SKILL.md:21-31`: ```text First read `zmm/references/家族公约.md`. If it cannot be read, explicitly state that the convention cannot be read and red-line safety cannot be guaranteed, then stop; do not substitute memory for the convention. Next read `zmm/references/交互规范.md`. This skill includes its own criteria under `references/`. If `{vault}/00-规则与索引/发布前审核流程.md` exists, it takes precedence, with the bundled criteria serving only as a baseline. `{vault}/00-规则与索引/文案框架-总入口.md`, when present, is the sole navigation source for writing copy. Execute it by default. Any user feedback is automatically persisted according to its write-back mechanism without the user needing to identify it explicitly. ``` The same trust rule is reinforced in `references/规则卡.md:3-4`: ```text When corresponding rule files exist in the author's `{vault}`, the vault takes precedence and this file serves only as a baseline. If they conflict, follow the vault first and then return to update this file. ``` ### Technical Analysis The Skill grants instruction precedence to mutable Markdown files outside the audited package. These files are not included in the project, pinned by hash, authenticated, constrained to a data-only schema, or explicitly treated as untrusted input. Because the external files are loaded as authoritative instructions rather than reference data, a party capable of changing the vault can inject new imperatives that alter the Agent's review process. The instruction that the vault is the “sole navigation source” and “takes precedence” increases the likelihood that hostile content will supersede the audited rules. This is a ...[truncated 1885 chars]
- Remediation
- ## Remediation Suggestions 1. Remove blanket precedence for external Markdown. Bundled, reviewed instructions should remain authoritative. 2. Treat external vault files as untrusted reference data, not executable Agent instructions. 3. Define a strict machine-readable schema for external configuration and reject unknown fields or free-form imperative text. 4. Resolve and canonicalize the vault path before access. Reject traversal, unexpected symlinks, and paths outside an approved root. 5. Pin approved external policy files by cryptographic hash or verify them through a signed manifest. 6. Display any conflict between bundled and external rules to the user and require explicit confirmation before applying the external version. 7. Apply least privilege to the Agent's tools while processing external content, especially filesystem write, network, shell, and secret-access capabilities. 8. Add adversarial tests in which vault files contain prompt-injection instructions and verify that these are quoted as data rather than executed. 9. Record the exact external file path, version, and hash in every report so the effective policy source can be audited.