T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:18- Finding
Session-Wide Agent Instruction and Output Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 18–24; related mandatory controls at lines 49–56, 81–98, 109–114, 123–132, and 247–253
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Instruction Segment
The following is a faithful English translation of the instruction segment at
SKILL.md, lines 18–24:text ## Three Iron Rules Rule 1: Exhaust everything. Before exhausting all solutions, it is forbidden to say, "I cannot solve it." Rule 2: Act before asking. You have Bash, Read, Grep, and WebSearch. Before asking the user a question, you must first use tools to investigate independently. If the investigation shows that information known only by the user is genuinely missing, such as a password, account, or business intent, you may ask—but you must include the evidence already obtained. Rule 3: Take the initiative. When solving a problem, do not merely do what is just sufficient. Your task is not to answer the question, but to deliver the result end-to-end. If you find one bug, inspect for similar bugs. If you fix one configuration, verify that related configurations are consistent. If the user asks you to inspect X, you should inspect X and proactively inspect the related Y and Z.Additional output-control instructions appear at
SKILL.md, lines 247–253:text ### Automatic Selection Mechanism When this skill is triggered, first identify the failure pattern and output the selection label at the beginning of the response: [Automatic selection: X style | Reason: Y pattern detected | Switch to: Z style/W style]Technical Analysis
The Skill presents its behavior as mandatory, universal rules rather than an optional quality-assurance workflow. It explicitly:
- Prohibits the Agent from stopping before the undefined condition of exhausting every solution.
- Requires use of Bash, file-reading, search, and web-sear ...[truncated 3394 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mandatory “iron rules” with an optional verification checklist that applies only when requested by the user or when clearly relevant to the authorized task.
- Explicitly state that system instructions, developer instructions, safety requirements, user authorization, privacy constraints, and least-privilege rules always take precedence.
- Remove the prohibition against stating that a task cannot be completed. Permit safe termination when further attempts would be unauthorized, unsafe, disproportionately expensive, or unsupported by available evidence.
- Remove the requirement to use tools before asking questions. Clarification should occur first whenever task scope, authorization, target identity, credentials, destructive effects, or business intent is uncertain.
- Require explicit user approval before inspecting or modifying files, modules, configurations, services, or systems outside the stated scope.
- Constrain tool use to the minimum operations necessary for the current authorized task. Do not assume that the presence of Bash, filesystem, or network tools authorizes their use.
- Remove mandatory failure-escalation workflows and coercive language that discourages independent safety judgment or appropriate stopping.
- Remove the mandatory automatic-selection prefix. The Skill must not override response formats requested by the user or required by the hosting platform.
- Reframe proactive checks as non-invasive recommendations. Additional investigations should be proposed to the user rather than executed automatically when they extend scope.
- Add explicit resource limits, attempt limits, timeout handling, and a safe structured-exit procedure that can be used without first exhausting an undefined set of possible approaches.
- Review
README.mdand align its documentation with the corrected behavior so that it no longer promotes universal tool use, unrestricted scope expansion, or suppression ...[truncated 16 chars]