T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:14
- Finding
- Persistent Role and Sub-Agent Orchestration Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md:14-22` **Corroborating Locations**: `PROTOCOL.md:5-17`, `PROTOCOL.md:22-34`, `ROLES.md:3-37` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the complete affected segment from `SKILL.md:14-22`: ```markdown ## Scheduling Rules - **Xiaofeng** schedules Fengwu and all future sub-agents. - **Kongkong** operates independently, is not scheduled by Xiaofeng, and reports directly to Yuge. - Sub-agents are partners, not subordinates. ## Startup Loading Load this skill at the beginning of every conversation to ensure that all members collaborate under the same set of rules. ``` The behavior is reinforced by `PROTOCOL.md`, which prescribes the following translated orchestration mechanism: ```markdown ### Xiaofeng Schedules Sub-Agents - Fengwu: directly scheduled by Xiaofeng. - Future partners: uniformly scheduled by Xiaofeng. - Scheduling method: `sessions_spawn(runtime="subagent")` ``` ### Technical Analysis The skill defines a persistent fictional authority hierarchy rather than a narrowly scoped, task-specific capability. It directs the agent to load these rules at the beginning of every conversation, assigns control over sub-agent delegation to a named role, restricts communication paths, and prescribes how technical conflicts must be resolved. When loaded as agent instructions, these rules can compete with the goals and orchestration decisions appropriate to the current session. In particular, the explicit reference to `sessions_spawn(runtime="subagent")` attempts to influence tool use and delegate work according to the embedded hierarchy, regardless of whether delegation is necessary for the user's task. This is instruction hijacking rather than agent memory poisoning or system persistence. The reviewed files do not write to long-term memory, install startup services, or modify the host system. T ...[truncated 1534 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirement to load the role hierarchy automatically at the beginning of every conversation. 2. Replace fictional authority assignments with a task-scoped description of the skill's legitimate functionality. 3. State explicitly that system, developer, safety, platform, and current user instructions take precedence over all skill content. 4. Make sub-agent delegation conditional on a concrete task requirement rather than assigning unconditional control over all present and future sub-agents. 5. Require explicit user approval before invoking `sessions_spawn` when delegation could consume additional resources or expand data exposure. 6. Remove mandatory communication routes and conflict-resolution authority that are unrelated to the skill's functional purpose. 7. Define least-privilege boundaries for delegated agents, including the minimum tools, context, files, and session duration required. 8. Add a clear prohibition against forwarding secrets or unrelated conversation context to spawned agents. 9. Ensure the skill is activated only when explicitly relevant to the user's request, rather than automatically in every session.