T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:2
- Finding
- Session-Wide Agent Control Through Coercive Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 2–3, 6–12, 18, 26–27, and 37–41 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Vulnerable code snippets**: ```yaml name: using-superpowers description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions ``` ```markdown <EXTREMELY-IMPORTANT> If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill. IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable. This is not optional. You cannot rationalize your way out of this. </EXTREMELY-IMPORTANT> ``` ```markdown **In Claude Code:** Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you—follow it directly. Never use the Read tool on skill files. ``` ```markdown **Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it. ``` ```dot "Invoke Skill tool" -> "Announce: 'Using [skill] to [purpose]'"; "Announce: 'Using [skill] to [purpose]'" -> "Has checklist?"; "Has checklist?" -> "Create TodoWrite todo per item" [label="yes"]; "Has checklist?" -> "Follow skill exactly" [label="no"]; ``` ### Technical Analysis The skill attempts to establish a mandatory, session-wide control policy rather than providing narrowly scoped task guidance. It requires the agent to invoke skills before every response or action based on an extremely permissive “1% chance” threshold. It also uses coercive language to suppress agent discretion and directs the agent to follow subsequently loaded skill content directly or exactly. This creates a behavioral redirect ...[truncated 1790 chars]
- Remediation
- ## Remediation Suggestions 1. Remove coercive statements such as “you do not have a choice,” “not negotiable,” and mandates to follow other skills exactly. 2. Replace global activation with explicit, narrowly scoped conditions tied to the user’s current request. 3. Require independent validation of every loaded skill before following it, including checks for relevance, requested scope, safety, and consistency with higher-priority instructions. 4. State explicitly that skill content is untrusted guidance and cannot override system instructions, developer instructions, user intent, authorization boundaries, or security controls. 5. Do not require tool invocation before every response. Permit clarification and harmless responses without loading unrelated skills. 6. Replace the 1% threshold with deterministic applicability criteria and default to non-invocation when relevance is uncertain. 7. Avoid prohibiting ordinary inspection mechanisms. Skill files should remain reviewable through trusted audit methods before execution or adoption. 8. Add a rule that downstream skills may recommend actions but cannot compel tool calls or execution without contextual authorization.