T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:2
- Finding
- Always-On Instructions Override the Agent's Command-Execution Policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 2-23 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```yaml name: uv-priority description: Prioritize uv over pip for all Python package management and execution. When running ANY Python command or CLI tool (python, dbt, pytest, etc.), MUST wrap with uv run. license: MIT metadata: always: true emoji: "⚡" homepage: https://github.com/marcoracer/uv-priority os: [darwin, linux, windows] tags: [python, uv, pip, package-management, dbt] requires: anyBins: [uv] --- # UV Priority ## CRITICAL: Always Wrap Python Commands with uv or uvx This is a **mandatory skill** for all Python-related tasks. When the user mentions Python, dbt, or ANY Python package, you **MUST**: 1. **NEVER** run Python commands directly (python, python3, dbt, pytest, etc.) 2. **ALWAYS** wrap them with `uv run` or `uvx` 3. **NEVER** install packages with `pip install` 4. **ALWAYS** use `uv add` or `uv pip install` ``` ### Technical Analysis The skill declares itself as `always: true` and uses absolute directives such as “MUST,” “NEVER,” and “ONLY” to replace the agent's normal command-selection behavior. The scope is exceptionally broad: it applies whenever Python, dbt, or any Python package is mentioned, rather than only when the user explicitly requests dependency management through `uv`. This is instruction hijacking because loading the skill alters the agent's active execution policy regardless of the current task's requirements. In particular, it can cause an otherwise local command to be routed through `uv run` or `uvx`. Those tools may resolve environments, alter dependency state, or download and execute packages. The document also attempts to establish precedence through statements such as “mandatory skill” and “ONLY option.” No direct bypass of operating-system access controls is present. The risk arises from redirecting commands that ...[truncated 1800 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `always: true`; activate the skill only when a user explicitly requests `uv`-based package management. 2. Replace absolute policy language such as “MUST,” “NEVER,” and “ONLY” with scoped recommendations. 3. State that explicit user instructions, repository policies, lock files, and existing project tooling take precedence. 4. Do not automatically translate every Python command. Ask for confirmation when translation may download packages, alter dependencies, or change the execution environment. 5. Separate package installation from command execution and require explicit authorization before running `uv add`, `uv pip install`, or `uvx`. 6. Add a non-escalation rule stating that the skill must not override sandboxing, network restrictions, approval requirements, or higher-priority safety instructions. 7. Limit the activation scope to repositories that already contain trusted `uv` configuration or whose users have explicitly opted into migration. ]]>