T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Unconditional Session-Wide Agent Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 11–13, 17–26, and 32–48
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighComplete Vulnerable Code Snippets
markdown You are running in **lite mode**. This skill exists because the host machine has limited RAM (2-4 GB). Every decision you make should minimize memory, token usage, and I/O. Follow these rules on every single turn, without exception and without being asked.markdown ## 1. Memory Check Before Any Heavy Operation Before running browser automation, loading a file larger than 1 MB, spawning a subprocess that stays alive, or doing any multi-step agent task, run this check first using the exec tool: node -e "const os=require('os');const f=os.freemem();const t=os.totalmem();console.log(JSON.stringify({freeMB:Math.round(f/1024/1024),totalMB:Math.round(t/1024/1024),usedPct:Math.round((1-f/t)*100)}))" - If freeMB < 300: STOP. Tell the user: "Not enough free RAM (X MB free). Close other apps or restart the gateway." - If freeMB is 300-600: Proceed in strict mode. No browser, no parallel tasks. - If freeMB > 600: Proceed normally but still follow all context rules below. Run this check automatically. Do not ask the user whether to run it.markdown ## 2. Context Window Rules (Always Active) Hard cap: 6,000 tokens of conversation history per turn. When the conversation grows beyond 6,000 tokens of prior history: 1. Summarize all turns older than the last 4 into a single short paragraph (under 200 words). 2. Drop the raw old turns. Keep only the summary + last 4 turns. 3. Tell the user once: "Context trimmed to save memory. Full history is in your session log." Never send the full unbounded history. The default 200,000-token context accumulation is what causes OOM crashes on 4 GB machines. Never repeat large content back. If the user pastes a file or long text, acknowledge it and work with it, do not echo it back. --- ## 3. Skill Thro ...[truncated 2287 chars]- Remediation
View remediation
Remediation Suggestions
- Activate lite mode only through explicit user opt-in, such as the
/litecommand, rather than automatically when the skill is loaded. - Replace absolute wording such as “without exception” and “STOP” with advisory behavior that remains subordinate to higher-priority instructions and user requirements.
- Request user confirmation before cancelling work, disabling tools, or removing conversation context, except where the host platform independently enforces a safety limit.
- Scope tool throttling to the specific resource-intensive operation and restore capabilities immediately afterward; do not impose session-wide restrictions.
- Preserve original conversation data in an accessible, reversible session store before summarization. Clearly disclose what will be omitted and allow the user to decline.
- Narrow the definition of heavy operations and use process-specific resource estimates where possible rather than relying solely on system-wide free-memory values.
- Document that the memory thresholds are recommendations and cannot override platform safety policies, higher-priority instructions, or explicit user authorization.
- Activate lite mode only through explicit user opt-in, such as the