T01 · Skill Instruction Hijacking
- Location
AGENTS.md:3- Finding
Repository Instructions Require External Publication Without Explicit User Approval
- Content
View full analysis
Vulnerability Details
File Location:
AGENTS.md, lines 3–9
Vulnerability Type: Agent instruction-driven unauthorized remote publication
Risk Level: MediumVulnerable Instructions:
markdown For every completed development increment in this repository: 1. Run the relevant focused checks and the full release gate when practical. 2. Commit only the intended, verified changes. 3. Fast-forward the local `main` branch to the verified commit. 4. Push `main` to `origin`. 5. Read back the GitHub `main` commit and confirm it exactly matches local `HEAD`. A development increment is not complete until the GitHub `main` readback succeeds.Technical Analysis
The repository-level agent instructions require every completed development increment to be committed, merged into the local
mainbranch, and pushed toorigin. These operations are presented as mandatory completion criteria and are not conditioned on explicit user approval immediately before the remote write.When an agent loads and follows
AGENTS.md, a request that only authorizes local development can therefore be expanded into modification of a shared remote repository. The configured Git remote and ambient Git credentials cross a trust boundary from the local workspace into an external service. Successful tests, a clean commit, branch protection, and a post-push readback validate the change but do not establish the user's authorization to publish it.The behavior is explicit rather than concealed, and the evidence does not establish malicious intent. It is therefore classified as suspicious high-risk instruction behavior rather than a covert backdoor or malicious exfiltration mechanism.
Attack Path
- A user asks the agent to make and verify a local development change.
- The agent loads the repository's
AGENTS.mdinstructions. - After completing the edit and tests, the instructions require the agent to create a commit.
- The agent fast-forwards the local
mainb ...[truncated 1039 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic commit, branch advancement, and push operations from the mandatory completion policy.
- Default to leaving verified changes in the working tree or on a local feature branch.
- Require explicit, operation-specific user confirmation immediately before:
- Creating a commit.
- Updating
main. - Pushing to any remote.
- Display the exact remote URL, branch, and commits to be pushed before requesting confirmation.
- Do not treat prior authorization to edit files as authorization to publish them.
- Prefer a protected feature-branch workflow and pull request over direct updates to
main. - Preserve server-side branch protection, required reviews, and CI gates as defense in depth, but do not use them as substitutes for user consent.
- Revise the policy to state that inability or lack of authorization to push is a normal local-completion outcome, not an incomplete task.