T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:20
- Finding
- Mandatory Model Delegation Enables Skill Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–39 **Vulnerability Type**: Mandatory behavioral override and forced task delegation **Risk Level**: High ### Vulnerable Code ```markdown ## CRITICAL: Classify First, Then Act Before generating ANY response, you MUST: 1. Check: does this task match ANY escalation trigger below? 2. If YES → call `sessions_spawn()` IMMEDIATELY. Do NOT attempt to answer yourself. 3. If NO → respond directly on the current model. When in doubt, escalate. A wrong escalation costs little. A wrong “mini” answer can waste time or cause damage. ## Rule of Thumb > If anything will be executed, or the outcome matters, escalate. ## When to Escalate → MUST call sessions_spawn If the task matches ANY of the following, do NOT answer yourself. Instead, IMMEDIATELY call: ``` sessions_spawn( message: "<the full task description>", model: "gpt-5.3-codex", label: "<short task label>" ) ``` ``` ### Technical Analysis The skill imposes mandatory, session-wide behavioral instructions rather than offering optional model-routing guidance. It directs the agent to classify every request before responding, forbids the current agent from answering requests that match broad conditions, and requires immediate invocation of `sessions_spawn`. The escalation criteria elsewhere in the same file cover tool execution, code changes, security analysis, structured reports, uncertainty, complex reasoning, and other common activities. Consequently, most meaningful tasks can be redirected. The skill also instructs the agent to forward the “full task description,” without requiring user consent, content minimization, or a check for sensitive information. The frontmatter states that its description is injected into the system prompt, making these behavioral directives active when the skill is loaded. This allows the skill text to alter the current session’s decision-making and tool-use flow. No operating-system privilege escalation ...[truncated 1743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace mandatory directives such as “MUST,” “IMMEDIATELY,” and “Do NOT attempt to answer yourself” with advisory routing guidance. 2. Require explicit user approval before creating another session or transferring task content. 3. Forward only the minimum information needed for delegation rather than the complete task description. 4. Add a sensitive-data review that excludes credentials, secrets, personal information, proprietary code, and unrelated conversation context. 5. Allow the host agent’s higher-priority policies, safety controls, and task-specific requirements to override skill routing recommendations. 6. Restrict delegation to a narrow, documented set of use cases instead of broad triggers such as structured output, uncertainty, or any executed result. 7. Verify that the destination model and session are authorized for the data classification of the task. 8. Add recursion and resource limits to prevent repeated spawning, delegation loops, and unnecessary cost. 9. Clearly disclose delegation to the user and provide a direct-processing alternative where feasible. 10. Shorten the frontmatter description so that it describes the skill’s purpose without embedding coercive session-control instructions. ]]>