T01 · Skill Instruction Hijacking
Warning
- Location
scripts/skill_generator.py:88- Finding
Untrusted Specification Content Is Amplified into Agent Instructions
- Content
View full analysis
"SkillSpec": """Load a SkillSpec from a YAML file.""" data = yaml.safe_load(path.read_text()) return cls( **{k: v for k, v in data.items() if k in cls.__dataclass_fields__} ) def validate(self) -> list[str]: """Return a list of validation errors (empty if valid).""" errors = [] if not self.name: errors.append("name is required") if not self.purpose: errors.append("purpose is required") if len(self.name) > 50: errors.append("name too long (max 50 chars)") if not self.name.replace("-", "").replace("_", "").isalnum(): errors.append( "name must contain only alphanumeric, hyphens, underscores" ) return errors ``` ### Technical Analysis The `critical_constraints` field is loaded directly from the input YAML and interpolated into the generated `SKILL.md`. Its values receive no type, length, content, or policy validation. The generator then strengthens each value with imperative language such as `MUST`, `non-negotiable`, and `NEVER skip or rationalize around them`. Because `SKILL.md` is intended to ...[truncated 2021 chars]- Remediation
View remediation