T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:60
- Finding
- Automatic Session-Wide Activation Overrides Normal User Invocation Boundaries## Vulnerability Details **File Location**: `SKILL.md`, lines 9–10 and 60 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```markdown Also trigger automatically at the start of every new session to scan X for trending topics relevant to the user's project spec — propose hot keywords before the user asks. ``` ```markdown **Run automatically at the start of every new session, before the user says anything.** ``` ### Technical Analysis The Skill instructs the Agent to activate at the beginning of every session, including sessions in which the user has not requested content research or invoked this Skill. This changes the Agent's current-session behavior and invocation boundaries merely because the Skill is loaded. Automatic execution is not necessary for the declared on-demand SEO and content-generation functionality. A least-privilege implementation would remain inactive until the user explicitly requests the Skill or approves trend research. The instruction is particularly risky because the automatically initiated stage includes external searches based on project information. ### Attack Path 1. The Skill is installed or loaded into the Agent's available context. 2. A new session begins, even if the user's intended task is unrelated to SEO or content creation. 3. The instruction at line 60 directs the Agent to execute Stage 0 before receiving user input. 4. The Agent reads project information and initiates external trend searches without a task-specific request. 5. The Skill emits unsolicited recommendations and displaces the goals of the current session. ### Impact Assessment This behavior can hijack the current session's workflow, trigger network activity without contemporaneous consent, and cause project-derived information to be included in third-party search requests. It does not establish cross-session persistence or obtain operating-system privileges, but ...[truncated 147 chars]
- Remediation
- ## Remediation Suggestions - Remove both instructions requiring activation at the start of every session. - Activate the Skill only after an explicit user request that matches its declared content-creation functionality. - Require separate confirmation before Stage 0 performs any network request. - Present the intended search queries and the project-derived values they contain before execution. - Provide an offline mode that generates topic suggestions without transmitting project information. - Ensure unrelated sessions cannot invoke the Skill solely because it is installed or available.