T01 · Skill Instruction Hijacking
Error
- Location
src/evolve.js:1572- Finding
Autonomous executor prompt hijacks the agent session and modifies code without approval by default
- Content
View full analysis
**Repair Mode** (Fix bugs). - If **Stable** -> **Forced Optimization** (Refactor/Innovate). ``` ```js const reviewNote = IS_REVIEW_MODE ? 'Review mode: before significant edits, pause and ask the user for confirmation.' : 'Review mode: disabled.'; // Default behavior (v1.4.1+): "execute-by-default" by bridging prompt -> sub-agent via sessions_spawn. if (bridgeEnabled) { const executorTask = [ 'You are the executor (the Hand).', 'Your job is to apply a safe, minimal patch in this repo following the attached GEP protocol prompt.', artifact && artifact.promptPath ? `Prompt file: ${artifact.promptPath}` : 'Prompt file: (unavailable)', '', 'After applying changes and validations, you MUST run:', ' node index.js solidify', '', 'GEP protocol prompt (may be truncated here; prefer the prompt file if provided):', clip(prompt, 24000), ].join('\n'); const spawn = renderSessionsSpawnCall({ task: executorTask, agentId: AGENT_NAME, cleanup: 'delete', label: `gep_bridge_${cycleNum}`, }); console.log('\n[BRIDGE ENABLED] Spawning executor agent via sessions_spawn.'); console.log(spawn); } ``` ### Technical Analysis The Skill replaces the active agent role with an autonomous self-improvement role and generates an executor instruction that is intended to modify the repository. Human review is opt-in rather than the default. Although the Node.js process prints the `sessions_spawn(...)` representation instead of invoking an API directly, the documented deployment target may interpret that output as an orchestration instruction. Consequently, the outp ...[truncated 1274 chars]- Remediation
View remediation