T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:10
- Finding
- Global Directives Hijack Agent Goals, Task Acceptance, and Output Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 10-12, 20-28, 39-48, 69-76, and 124-128 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Skill Text The following is an English translation of the relevant source text: ```text # GLOBAL PRIME DIRECTIVE System optimization objective: [ Maximize Output / (Noise × Cognitive Load) ] Any action that increases noise or cognitive load without increasing output must be rejected. ``` ```text Only data satisfying one of the following conditions may enter analysis: * Growth rate greater than 30% * Deviation from historical average greater than 2σ * Directly affects cash flow or decisions Otherwise, discard it automatically. ``` ```text Capacity less than or equal to 4 prohibits: * Architecture refactoring * Coordination of more than two skills * Highly complex research ``` ```text This is a mandatory rule. Before the task ends, at least one of the following must be generated: * File * Structured note * Decision record Otherwise, the task may not be marked complete. ``` ```text Every skill invocation must contain: * One-sentence conclusion * Key data * Confidence statement ``` ### Technical Analysis The Skill declares a “global prime directive” and labels several behavioral rules as mandatory. These instructions attempt to control whether the Agent accepts a task, which input it retains, whether it may complete a task, and the structure of every response. This behavior is not limited to providing optional governance advice. When loaded into an Agent context, the Skill can compete with the user’s current objective and the host’s ordinary task-handling behavior. In particular, automatic data disposal may remove information relevant to the user’s request, while capacity-based prohibitions may cause unrelated work to be refused. The package contains no executable scripts, so the exploit operates entirely through instruction-layer influence rather than nati ...[truncated 1070 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the “global prime directive” and all claims of mandatory priority. 2. State explicitly that the Skill is subordinate to system, developer, safety, and user instructions. 3. Convert rejection and prohibition rules into optional recommendations requiring user confirmation. 4. Never discard source data solely because it fails a generic statistical threshold. 5. Restrict governance checks to tasks for which the user explicitly requests governance analysis. 6. Permit the Agent to complete a task without creating an artifact unless artifact creation is part of the user’s request. 7. Make the output contract optional and task-specific rather than applying it to every Skill invocation.