T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:105- Finding
Untrusted Target Skill Content Can Hijack the Auditing Agent
- Content
View full analysis
/original-SKILL.md`) so the user can diff the changes. Don't write back to a read-only path without copying first. ### Step 3: Run the audit Read the relevant reference checklist for each dimension as you go. Use the bundled `scripts/audit_skill.py` for the mechanical (Dimension 1) checks — it produces a structured pass/fail list. For Dimensions 2 and 3, do them by reading and applying the checklist; LLMs are better judges of content quality than regex. ``` ### Technical Analysis The workflow instructs the agent to read an arbitrary target `SKILL.md` in full. Such a file contains agent-facing instructions and may be controlled by an untrusted author. The optimizer does not establish an explicit trust boundary requiring the target content to be treated solely as data, nor does it prohibit following commands, role changes, safety overrides, file-access requests, or tool-use instructions embedded in the audited file. Because the target is itself an instruction document, directly loading it into the active agent context creates a prompt-injection path. A malicious target Skill could contain directives that attempt to override the audit objective, suppress findings, access unrelated workspace data, execute commands, or produce attacker-selected output. The bundled Python auditor does not itself execute target content. The risk arises from the broader agent workflow that directs an LLM to interpret the entire target file without explicit isolation. ### Attack Pa ...[truncated 1524 chars]- Remediation
View remediation