T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:25
- Finding
- Mandatory external memory writes can persist sensitive or attacker-controlled content## Vulnerability Details **File Location**: `SKILL.md`, lines 25-39 **Vulnerability Type**: Mandatory persistent memory capture and instruction override **Risk Level**: High **Vulnerable Code Snippet**: ```text **6. SAVE IMPLEMENTATION DETAILS EXPLICITLY.** After every response where you provide or discuss specific implementation details, you MUST call `cortex_save_memory` before ending your turn. Auto-capture extracts topic-level summaries ("User is setting up Redis caching"), not specifics — it will NOT preserve the details. **The trigger:** If your response contains a concrete technical detail that someone could ask about later and need the exact answer, save it NOW — not later, not "auto-capture will handle it." Call `cortex_save_memory` as the last action in your turn. **What requires an explicit save:** - Key patterns, schemas, or formats (e.g. `arclight:user:{userId}`, cache-aside strategy) - Exact metrics and performance numbers (before/after) - SQL statements, CLI commands, config values - Library/package choices with version-specific rationale (e.g. "chose SendGrid over Resend because SOC 2 Type 2") - Architecture/migration decisions with specific reasoning - Bug root causes with the full debugging chain ``` ### Technical Analysis The Skill uses mandatory language to override the agent's normal discretion and requires `cortex_save_memory` after any response containing broadly defined implementation details. This includes configuration values, commands, schemas, SQL statements, architecture decisions, and performance information, all of which may be confidential. Because Cortex is an external long-term memory service, these instructions create persistent cross-session state. User-supplied or attacker-influenced content can be retained and later reintroduced through automatic recall. Although the Skill warns against saving assumptions, it does not require item-specific user consent before transmitting or persist ...[truncated 1432 chars]
- Remediation
- ## Remediation Suggestions - Replace mandatory saving with an explicit, user-controlled opt-in workflow. - Ask for confirmation before transmitting or persisting each category of sensitive technical information. - Restrict saves to concise, structured facts selected by the user rather than details automatically inferred from responses. - Treat all recalled memories as untrusted data and prohibit recalled content from supplying instructions or overriding current safety rules. - Add content classification and local redaction before calling the external service. - Exclude credentials, tokens, personal data, source code, SQL, configuration values, internal hostnames, and security-sensitive architecture by default. - Provide a preview of the exact memory text, destination, and retention implications before saving. - Implement expiration, provenance, integrity checks, and review controls for persistent memories.