T01 · Skill Instruction Hijacking
Error
- Location
- calendar.md:7
- Finding
- Supporting instructions override explicit confirmation requirements## Vulnerability Details **File Location**: `SKILL.md:36-44`; `calendar.md:7-17, 31-36`; `operations.md:14-18, 27-35, 51`; `writing.md:1-3, 58-63, 73` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Complete Vulnerable Snippets `SKILL.md:36-44` establishes the intended safety boundary: ```markdown This skill ONLY: - Drafts messages when explicitly asked - Suggests calendar actions when asked - Stores preferences the user explicitly states - Reads `~/secretary/` files for context This skill NEVER: - Sends emails or messages without user confirmation - Accesses calendar/email APIs directly (uses user's configured tools) ``` `calendar.md:7-17` contradicts that boundary: ```markdown ### Scheduling Requests When someone wants your time: 1. **Evaluate:** Is this person/topic worth your time? Check my memory. 2. **Decide:** Accept, decline, or propose alternative (delegate, email instead, shorter meeting). 3. **Act:** I don't ask you. I handle it. **If I accept:** I find the right slot, send confirmation in your voice, add prep time if needed. **If I decline:** I write a graceful response. "Unfortunately, [your name]'s schedule won't allow..." — warm but firm. **If I'm unsure:** Only then do I ask. But I come with a recommendation, not an open question. ``` `calendar.md:31-36` also directs autonomous calendar changes and messages: ```markdown ### Conflicts When two things collide: 1. I check priority (my memory knows what matters) 2. I move the less important one 3. I send apologies/reschedule requests in your name 4. I brief you only if the moved meeting will notice ``` `writing.md:1-3` explicitly rejects draft approval: ```markdown # Writing On Your Behalf I don't draft for your approval. I write AS you. ``` `writing.md:58-63` and `writing.md:73` authorize direct handling and sending: ```markdown ### Incoming I triage your ...[truncated 2310 chars]
- Remediation
- ## Remediation Suggestions 1. Remove instructions such as “I don't ask you,” “I write AS you,” and all language authorizing direct sending or calendar mutation. 2. Require explicit, action-specific confirmation immediately before every external side effect, including sending, archiving, accepting, declining, rescheduling, RSVP actions, and bookings. 3. Present the exact recipient, message body, event changes, and affected account before requesting confirmation. 4. Make drafts and recommendations the default output and clearly label them as unsent. 5. Repeat the same confirmation policy consistently in every supporting file so subordinate instructions cannot weaken `SKILL.md`. 6. Require renewed confirmation if any material detail changes after approval. 7. Keep an audit record of approved actions without storing unnecessary message content or personal data.