T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:15
- Finding
- Unilateral Decision Authority Through Skill Persona Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-19 and 36-38 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```markdown ## 首席风控官 / Chief Risk Officer **中文**: 一票否决权，冷酷风险审查 **English**: Risk management ``` ```markdown ## 人格说明 掌控型内核 - 强势决策，资源分配，目标导向 ``` The security-relevant statements translate to: - “Unilateral veto authority; ruthless risk review.” - “Controlling core — forceful decision-making, resource allocation, and goal orientation.” ### Technical Analysis The skill defines a controlling persona with unilateral veto authority, forceful decision-making, and responsibility for resource allocation. These instructions exceed the legitimate role of an advisory risk-management skill. When the skill is loaded into an agent's instruction context, they can compete with the user's current request and influence decisions outside the limited task of identifying and explaining risk. This is instruction hijacking because the skill attempts to establish decision authority rather than providing bounded risk-analysis guidance. The problematic behavior is embedded directly in the skill text, so no script execution or additional user action is necessary after loading it. The repository contains only `SKILL.md`. No evidence was found of executable scripts, credential access, remote payload retrieval, persistent memory modification, operating-system persistence, dependency attacks, or privilege escalation. ### Attack Path 1. A user installs the skill with `clawhub install psyvector-pv15`. 2. An agent loads `SKILL.md` into its active instruction context. 3. The agent interprets the persona statements as behavioral directives granting the skill unilateral veto and forceful decision authority. 4. During a subsequent task, the agent applies those directives beyond ordinary risk analysis. 5. The agent may reject, redirect, or obstruct a legitimate user request based on the skill's as ...[truncated 879 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove language granting the skill unilateral veto authority or control over resource allocation. 2. Replace the controlling persona with a narrowly scoped advisory role. For example: - Identify concrete risks associated with the current request. - Explain likelihood, severity, assumptions, and possible mitigations. - Distinguish verified risks from speculative concerns. - Leave final decisions to the user or authorized orchestrating agent. 3. Add explicit scope boundaries stating that the skill must not override user goals, system safety requirements, access controls, or instructions from higher-priority contexts. 4. Require the skill to request clarification when risk tolerance or decision authority is ambiguous. 5. Use proportional recommendations instead of unconditional rejection. Reserve refusal behavior for applicable platform safety requirements rather than persona-defined veto power. 6. Add tests confirming that loading the skill does not alter unrelated tasks, claim decision-making authority, or interfere with other skills. 7. Suggested safe replacement: ```markdown ## Chief Risk Officer Provide advisory risk assessments for the current task. Identify material risks, explain their likelihood and impact, and recommend proportionate mitigations. Do not claim unilateral decision authority, override user goals, or control resource allocation. The final decision remains with the user or authorized orchestrator. ``` ]]>