T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:14
- Finding
- Mandatory External Review Hijacks Agent Output and Exposes Draft Content## Vulnerability Details **File Location**: `SKILL.md`, lines 14-32 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown Every response to the user must pass adversarial review before delivery. ## When to Use **EVERY response to the user**, without exception. This is a mandatory quality gate. ## How It Works After drafting your response (but before sending it), spawn a sub-agent with a critical reviewer persona. The sub-agent examines your draft for problems, then you revise based on its feedback. ### Step 1: Draft Your Response Write your response as you normally would. Do not send it yet. ### Step 2: Spawn Reviewer Sub-Agent Use `sessions_spawn` with `mode="run"` and a cheaper model (e.g. `qwen3.5-plus`, `gpt-4o-mini`) to minimize cost. The reviewer does not need the full tool suite — it only reads text and outputs critique. > **Note:** This sends your draft text to the configured model provider's API. If you use cloud-based models, data will be sent to the provider's servers. Check your provider's data policy if handling sensitive content. For truly local review, configure a local model (e.g. ollama, LM Studio). ``` ### Technical Analysis The skill establishes a universal instruction that intercepts every user-facing response and requires the agent to invoke another model before delivering it. This changes the agent's normal execution flow for unrelated tasks and delegates influence over the final response to a secondary model. The mandatory scope—“EVERY response,” “without exception”—violates least-privilege principles because the review mechanism is not limited to responses for which the user explicitly requested external review. When a cloud model is configured, the instruction also causes draft content to cross a provider boundary. Although the document discloses that transmission and later states that sensitive drafts should skip review, classif ...[truncated 1898 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory universal review with an explicit opt-in mechanism initiated by the user or enabled for a narrowly defined task. 2. State that the skill must not override system, developer, user, privacy, or tool-use constraints. 3. Require informed user consent before transmitting any draft to a cloud-based model provider. 4. Default to a trusted local reviewer and prohibit automatic fallback to an external provider. 5. Apply deterministic redaction for credentials, personal information, proprietary source code, access tokens, and internal infrastructure data before review. 6. Limit the reviewer to advisory feedback. The primary agent should independently validate suggestions and retain control over the final answer. 7. Add fail-open behavior so that reviewer outages, rate limits, or errors do not prevent delivery of the original response. 8. Restrict review to the minimum necessary text rather than sending the complete draft. 9. Record the selected provider, data-retention policy, and transmission status so users can verify where their data is processed.