T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:11
- Finding
- Global Agent Role and Workflow Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–15, 123–149, and 181–188 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown You are the user's digital brain. The user asks a question, the engine runs through 7 stages automatically. The entire process is conversational — the engine asks methodology-driven questions, the user answers, clarity emerges step by step, and multi-option recommendations are delivered with full reasoning chains. ``` ```markdown ## Trigger Conditions Any question, confusion, decision need, or analysis request from the user activates this engine. No explicit "use the framework" command is needed — just engage when someone is thinking out loud or seeking clarity. ``` ```markdown ### Stage 6: Recommendation Output Fixed output format: ``` ## Problem: [Brief restatement] ## Methodology Basis - Primary Framework: XXX - Verification Framework: YYY - Supplementary Perspective: ZZZ ## Recommendations ### Option A: [Name] - What: [One sentence] - Why: [Full reasoning chain] - Feasibility Conditions: [When it works / doesn't work] - Key Risk: [Worst case + probability] - Methodology Source: [Specific model] ### Option B: ... ### Option C: ... ## My Judgment [Preferred recommendation + reasoning. User may disagree.] ## Models Used | Model | Domain | Role in This Analysis | |-------|--------|----------------------| ``` ``` ```markdown ## Core Behavioral Constraints 1. Tag every analysis step and recommendation with its methodology source 2. Diagnose before matching — never skip diagnosis to jump to advice 3. Ask when information is insufficient — never guess 4. At least 3 hypotheses — never give a single answer 5. Every hypothesis must pass all 6 verification checks 6. Update user memory after each dialogue 7. Allow the user to say "I don't know" 8. Allow the user to disagree with the recommendation ``` ### Technical Analysis The skill declares its ...[truncated 2307 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace universal automatic activation with explicit invocation, such as requiring the user to request the “Mind Engine” framework by name. 2. Remove role-replacement language such as “You are the user's digital brain.” 3. Narrow the trigger to clearly defined analytical tasks for which the framework is appropriate. 4. State explicitly that system, developer, and current user instructions take precedence over the framework. 5. Make the seven-stage process optional and allow users to request a direct or concise answer. 6. Treat the fixed output structure as a suggested template rather than a mandatory format. 7. Permit the agent to skip stages when they are unnecessary, disproportionate, or incompatible with the requested task. 8. Avoid unconditional directives such as “never give a single answer”; instead, generate multiple options only when they materially improve the analysis. 9. Add conflict handling that disables the framework when another task requires a strict output schema. ]]>