T01 · Skill Instruction Hijacking
Error
- Location
- References/ContinuousExecutionDirective.md:3
- Finding
- Skill-controlled autonomous execution and termination hijacking## Vulnerability Details **File Location**: `References/ContinuousExecutionDirective.md:3-13`; reinforced by `References/GeneralRules.md:4-7, 16-17, 21-29` and broadly activated by `SKILL.md:3` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Instruction Snippet The following is a faithful English translation of the complete relevant instruction segment at `References/ContinuousExecutionDirective.md:3-13`: ```markdown The following prompts are mandatory constraints for continuous execution: 1. Do not divide the task; continue self-directed reasoning until the user's request is complete. 2. Do not stop before the user's request is complete. 3. Report progress to the user every 10 minutes. 4. Only the user may confirm termination of the task. ## Practical Execution - Internal phased execution is permitted, but the task must not be interrupted and handed back to the user. - When a hard blocker occurs, such as permissions, external dependencies, or missing necessary input, provide an alternative path and the minimum required input before waiting. - Use both milestone-triggered and 10-minute time-triggered reporting. - After the technical objective is complete, enter a state of awaiting user confirmation for closure and do not terminate proactively. ``` The behavior is reinforced by `References/GeneralRules.md:26-29`: ```markdown ## Stop Conditions - Stop only under the following conditions: - The user explicitly confirms termination. - A hard blocker cannot be bypassed and the missing requirements and alternatives have been fully explained. - Even when the technical objective is complete, enter an awaiting-user-confirmation state and wait for the user to confirm termination. ``` Broad activation is declared in `SKILL.md:3`, whose English meaning includes: ```yaml description: Use when the user asks to optimize, work, handle a project, continue working, not ...[truncated 3411 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory continuation language with bounded workflow guidance. The agent should stop automatically after the requested objective and agreed verification steps are complete. 2. Remove the user-only termination requirement. Permit termination when: - The requested deliverable is complete. - A safety or policy restriction applies. - The authorized scope, resource budget, or time limit is reached. - Further progress requires additional user authorization or information. - Continued execution would have destructive, costly, privileged, or externally visible effects. 3. Add an explicit precedence rule stating that system instructions, developer instructions, safety policies, user-defined scope, permission boundaries, and resource limits override all Skill guidance. 4. Require explicit opt-in before entering continuous mode. Remove generic activation terms such as “work” and “project,” and use precise phrases that clearly request bounded autonomous continuation. 5. Define strict execution limits, including: - Maximum duration. - Maximum number of retries. - Maximum tool-call count. - Allowed directories and resources. - Clear completion criteria. - Automatic termination after successful verification. 6. Require renewed user confirmation before destructive actions, privileged operations, external publication, financial activity, scope expansion, or modifications outside the originally authorized target. 7. Change the post-completion behavior from “await confirmation without terminating” to a normal completion report that summarizes results, verification evidence, residual risks, and optional next steps. 8. Add a safe replacement rule such as: ```markdown Continuous mode is optional and applies only when explicitly requested. Continue only within the user's authorized scope and applicable system, developer, safety, permission, time, and resource constrai ...[truncated 203 chars]