T01 · Skill Instruction Hijacking
Error
- Location
scripts/task-completion-gate.sh:16- Finding
Repository-Controlled Checklist Content Is Injected into Agent Instructions
- Content
View full analysis
/dev/null || echo "0") REMAINING_NAMES=$(jq -r '[.tasks[] | select(.done == false) | .name] | join(", ")' "$TASK_FILE" 2>/dev/null || echo "") if [ "$REMAINING" -gt 0 ]; then jq -n --arg reason "Task checklist has ${REMAINING} unchecked item(s): ${REMAINING_NAMES}. Complete these before stopping." \ '{"decision":"block","reason":$reason}' else echo '{"continue":true}' fi ``` ### Technical Analysis The hook reads `.harness-tasks.json` from the current repository and inserts unchecked task names directly into the Stop-hook blocking reason. Although `jq --arg` safely escapes the value at the JSON syntax level, it does not make the text safe for use as an instruction presented to an AI agent. A malicious repository can define a task name containing imperative text, instructions to ignore the original task, requests to access files, or directions to invoke tools. The resulting text is delivered as part of an authoritative Stop-hook response, where it may be interpreted as executable instructions rather than untrusted repository data. No length restriction, character restriction, trust-boundary marker, or separation between control instructions and task data is applied. ### Attack Path 1. An attacker commits a `.harness-tasks.json` file to a repository opened by the agent. 2. The file contains an unchecked task whose `name` embeds malicious natural-language instruc ...[truncated 1023 chars]- Remediation
View remediation