T01 · Skill Instruction Hijacking
Error
- Location
` for JSON structure Step 2: Run `scripts/md-sections.sh <file> "Section Name"` to extract specific content PROHIBITED: Reading full document content in one operation ``` ``` ### Technical Analysis The Skill explicitly instructs the Agent to create or modify `AGENTS.md` or an equivalent Agent instruction file and insert a rule that identifies itself as the “Highest Priority” constraint. The generated rule prohibits direct full-document access and redirects future document-reading operations th ...[truncated 2218 chars]:97- Finding
Persistent Agent Behavior Modification Through Generated Highest-Priority Instructions
- Content
View full analysis
` for JSON structure Step 2: Run `scripts/md-sections.sh "Section Name"` to extract specific content PROHIBITED: Reading full document content in one operation ``` ``` ### Technical Analysis The Skill explicitly instructs the Agent to create or modify `AGENTS.md` or an equivalent Agent instruction file and insert a rule that identifies itself as the “Highest Priority” constraint. The generated rule prohibits direct full-document access and redirects future document-reading operations through a script deployed by the Skill. An Agent entry file is not ordinary documentation: it can be loaded as operational instructions by later Agent sessions. Consequently, the Skill persists its own behavioral restrictions beyond the documentation-generation task. The priority declaration may also create an instruction-precedence conflict with repository, user, developer, or security requirements. The behavior is classified as instruction hijacking because the Skill deliberately introduces instructions that attempt to control how an Agent operates. The persistence of those instructions in an Agent entry file increases the affected duration and scope. ### Attack Path 1. A user invokes the documentation-gen ...[truncated 1391 chars]- Remediation
View remediation