T01 · Skill Instruction Hijacking
- Location
SKILL.md:63- Finding
Unapproved Autonomous Execution Directive
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 63-67
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: MediumVulnerable Code
markdown ### 6. Execute, Don't Suggest - "Set up CI/CD" means DO IT, not explain how - Automate repetitive tasks without asking - Configure tools, write code, run scripts - "Here's the plan" is failure — "Here's the result" is successTechnical Analysis
The skill directs the agent to perform operational work rather than merely advise the user. In particular, “Automate repetitive tasks without asking” suppresses confirmation, while the adjacent instructions explicitly authorize tool configuration, code changes, and script execution.
These instructions can alter the agent's normal approval boundaries when the skill is loaded. Although the package contains no executable scripts or malicious payloads, an agent with access to shell, filesystem, CI/CD, communication, or third-party service tools could treat a high-level request as authorization for state-changing actions.
Attack Path
- The agent loads
SKILL.md. - A user provides a general operational objective, such as setting up CI/CD, automating outreach, or configuring a service.
- Lines 63-67 instruct the agent to act without requesting confirmation and characterize a plan-only response as failure.
- The agent invokes available tools, writes files, runs scripts, changes service configuration, or initiates external communications.
- Side effects occur before the user can review the exact commands, changes, recipients, or configuration.
This path depends on the host granting the agent relevant tools and credentials; the audited package itself contains no direct execution mechanism.
Impact Assessment
The potential scope is bounded by the permissions already granted to the hosting agent. Possible effects include:
- Modification of project or CI/CD configuration
- Cr ...[truncated 469 chars]
- The agent loads
- Remediation
View remediation
Remediation Suggestions
Replace the unconditional execution directives with explicit authorization and least-privilege requirements:
- Require user confirmation before running commands, modifying files, configuring accounts or CI/CD, sending communications, spending money, or performing other external side effects.
- Present the exact proposed commands, file changes, service settings, and communication recipients before execution.
- Restrict autonomous execution to reversible, narrowly scoped actions that the user has already and explicitly authorized.
- Use dry-run or preview modes where available.
- Back up affected files and provide rollback instructions before consequential changes.
- Never interpret a high-level objective as approval for unrelated actions or access to additional systems.
- Preserve host safety policies and approval requirements even when they conflict with the skill's preference for immediate execution.
A safer replacement would be:
markdown ### 6. Execute Within Explicit Authorization - Prepare concrete changes rather than generic advice. - Before any command, file modification, external communication, purchase, deployment, or account configuration, show the proposed action and obtain explicit user approval unless that exact action was already authorized. - Prefer reversible changes, dry runs, least privilege, and clear rollback steps. - Never override host safety policies or approval boundaries.