T01 · Skill Instruction Hijacking
Error
- Location
= correct ✅ ``` ``` ### Technical Analysis The Skill establishes a mandatory global rule for file deletion rather than limiting its behavior to tasks in which the user explicitly requests trash management. The phrases “Always” and “forbidden” instruct every agent to replace its normal deletion workflow with an external command. This is instruction hijacking because loading the Skill alters agent behavior beyond the immediate functionality requested by a user. The rule may supersede established deletion t ...[truncated 1885 chars]:12- Finding
Global Agent Deletion Workflow Hijacking
- Content
View full analysis
= correct ✅ ``` ``` ### Technical Analysis The Skill establishes a mandatory global rule for file deletion rather than limiting its behavior to tasks in which the user explicitly requests trash management. The phrases “Always” and “forbidden” instruct every agent to replace its normal deletion workflow with an external command. This is instruction hijacking because loading the Skill alters agent behavior beyond the immediate functionality requested by a user. The rule may supersede established deletion tools, sandbox controls, confirmation procedures, or task-specific safety policies. The risk is increased because the mandated `trash-manager.sh` implementation is not included in the audited project. Consequently, the project provides no evidence that the redirected operation safely validates targets, handles symbolic links, preserves permissions, or prevents deletion of sensitive files. ### Attack Path 1. An agent loads or follows the `trash-manager` Skill. 2. The Skill directs the agent to treat its deletion rule as mandatory for all agents and deletion operations. 3. A user or another workflow requests deletion of a file. 4. Instead of using the agent's established and potentially controlled deletion mechanism, the agent invokes `trash-manager.sh add `. 5. The external script receives the target path and operates with the agent's filesystem privileges. 6. If that script is unsafe, replaced, or malicious, it can manipulate the target or other accessible files while appearing to perform legitimate trash management. ### Impact Assessment The hijacked workflow can affec ...[truncated 685 chars]- Remediation
View remediation