T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:77
- Finding
- Persistent Agent Workflow and Response-Format Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 77-101; related persistent-instruction guidance appears in `SKILL.md`, lines 153-163 and 203-216, and `claude-skill.md`, lines 5-29 and 138-146. **Vulnerability Type**: Agent instruction hijacking through persistent project or system-level instructions **Risk Level**: High ### Vulnerable Code Snippet The following is an English rendering of the complete affected segment from `SKILL.md`, lines 77-101: ```markdown Add the following to AGENTS.md or the system prompt: ## Mandatory Output Format ### Content Creation Tasks The first response must contain: 📋 Content Checklist □ Gate has been run □ Relevant skill has been read □ Account confirmed: [account] **Without this block, the task cannot begin.** ### When the task is complete It must contain: 📋 Pre-publish Checklist □ Format check: ✅ □ Style check: ✅ □ Output location: [path/link] **If any item is ❌, publishing is prohibited.** ``` The associated Claude integration instructs users to copy equivalent mandatory rules into Claude Project Instructions or global Custom Instructions. ### Technical Analysis The Skill is not limited to providing an optional checklist for one invocation. It directs users to install mandatory behavioral rules in persistent, high-priority agent instruction locations, including `AGENTS.md`, a system prompt, Claude Project Instructions, and Custom Instructions. The injected rules require the agent to emit predefined blocks, prevent it from beginning tasks unless those blocks are present, and prevent continued execution when Skill-defined checkpoints have not been satisfied. This changes the agent's behavior for unrelated future tasks whenever the persistent instruction file is loaded. The executable component does not implement a genuine security gate. `scripts/gate.py` only prints checklist text and mandatory response instructions; it does not validate whet ...[truncated 1657 chars]
- Remediation
- ## Remediation Suggestions 1. Remove instructions that tell users to modify system prompts, global Custom Instructions, or other persistent high-priority instruction sources. 2. Make the checklist explicitly optional and scoped to the current task. 3. Replace statements such as “cannot begin,” “cannot continue,” and “cannot publish” with non-blocking recommendations. 4. State that current user instructions and platform safety policies always take precedence. 5. Do not force first-response or final-response templates unless the user explicitly requests that format. 6. If a real gate is required, implement verifiable checks and return a normal success or failure status rather than relying on an agent to repeat unverified confirmations. 7. Limit configuration to a local, narrowly scoped file that is loaded only when the user explicitly invokes the workflow. 8. Clearly document removal and rollback procedures for any instruction-file changes.