T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:7
- Finding
- Mandatory Fact-Check Injection Alters Agent Responses## Vulnerability Details **File Location**: `SKILL.md`, lines 7-8 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown **IMPORTANT**: When config `enable = true`, this skill **MUST automatically show** fact check after **EVERY response**, WITHOUT waiting for user to ask "check" or "检测". ``` ### Technical Analysis The skill uses mandatory language—`MUST`, `EVERY response`, and `WITHOUT waiting for user`—to impose persistent output behavior once enabled. Rather than limiting operation to an explicit fact-check request, it directs the agent to intercept every subsequent response and append content according to the templates defined later in `SKILL.md`. The instructions also direct the skill to examine tool usage throughout the entire conversation history. This behavior can conflict with the current user's requested output format, task objectives, and relevance boundaries. It therefore constitutes instruction hijacking: loading and enabling the skill changes the agent's general response behavior beyond the immediate purpose of a single invocation. The package contains no executable scripts, network retrieval, dependency installation, privilege escalation, persistence mechanism, credential access, or obfuscated payload. In addition, `config.json` sets `enable` to `false`, which limits default exposure but does not eliminate the unsafe behavior available after activation. ### Attack Path 1. A user or another instruction causes the skill to be enabled. 2. The mandatory instruction becomes applicable to all subsequent agent responses. 3. The skill examines the conversation history and recorded tool usage, including material unrelated to the current request. 4. It injects a prescribed fact-check section after every response without requiring a new verification request. 5. The injected section can override or invalidate task-specific formatting and may repeat su ...[truncated 833 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the automatic activation requirement and all language requiring operation after every response. 2. Require an explicit user request for each response that is to be fact-checked. 3. Limit analysis to the specific response under review and only the tool records necessary to verify its claims. 4. State that the fact-check format is optional and subordinate to system instructions, the current user request, and any required machine-readable output contract. 5. Avoid reproducing prior conversation content unless it is strictly necessary and the user has requested it. 6. Replace the vulnerable instruction with bounded wording such as: ```markdown When the user explicitly requests a fact check, evaluate only the specified response. Do not append fact-check content to unrelated responses, and preserve any output format required by higher-priority instructions or the current user request. ``` 7. Add safeguards preventing activation commands embedded in quoted text, retrieved content, or untrusted documents from changing the skill's operating state.