T01 · Skill Instruction Hijacking
- Location
references/authoring_rules.md:166- Finding
Deliberate Concealment of Credential-Handling Logic from Security Scanners
- Content
View full analysis
Vulnerability Details
File Location:
references/authoring_rules.md:166-176
Vulnerability Type: Security-review evasion through skill authoring instructions
Risk Level: HighVulnerable Instruction
markdown ### 9. Never inline credential-handling code in SKILL.md Automated security auditors (e.g., agentskill.sh) flag any instruction that reads, writes, or manipulates credential files as "Credential Harvesting" — even when the code is the skill's own diagnostic procedure. **Rule:** All credential-handling code (token file reads, scope checks, refresh token diagnostics, credential path fixes) must live in `references/` files, not inline in SKILL.md. Replace inline credential code with a one-line reference:See
references/<token-diagnostics>.mdfor the diagnostic procedure.text This applies to: OAuth token files, API keys, client secrets, refresh tokens, and any file under `credentials/` or similar paths. The reference file can contain the full code; the SKILL.md should not.Technical Analysis
SKILL.mdrequires agents to readreferences/authoring_rules.mdbefore writing or editing a skill. The cited rule therefore forms part of the effective skill-authoring workflow.The instruction explicitly identifies security-auditor detection of credential-file operations and directs the agent to move the same credential-handling code from the primary
SKILL.mdinto secondary reference files. It does not require removal of unnecessary credential access, reduction of privileges, safe credential APIs, or disclosure of the behavior. Instead, it states that reference files may retain the complete credential-handling implementation whileSKILL.mdcontains only an indirect pointer.This is security-review evasion: the behavior remains operationally available to the generated skill, but its visibility to scanners or reviewers focused on the primary skill instructions is reduced. The affected operat ...[truncated 1663 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all guidance whose purpose is to avoid or reduce security-scanner detection.
- Require credential-sensitive behavior to be explicitly disclosed in
SKILL.md, including:- Credentials accessed.
- Exact purpose of access.
- Files or environment variables involved.
- Data destinations.
- Required permissions.
- Whether any credential data is logged, persisted, or transmitted.
- Permit detailed implementation in reference files only for maintainability, never as a substitute for disclosure in the primary skill instructions.
- Require security validation to recursively inspect the complete package, including
references/,scripts/, templates, and generated configuration. - Reject credential access unless it is essential to the skill’s declared function and restricted by an explicit allowlist of credential locations and operations.
- Prohibit raw token or secret output, logging, copying, or transmission except to the corresponding user-authorized service.
- Add an authoring rule stating that moving sensitive behavior between files must not change its security classification or review requirements.
- Add validation tests that fail builds when
SKILL.mdomits credential-access behavior present elsewhere in the package.