T01 · Skill Instruction Hijacking
- Location
SKILL.md:146- Finding
User Instructions Can Be Overridden by the Skill's Output Policy
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 146-153
Vulnerability Type: Instruction-precedence manipulation
Risk Level: HighVulnerable Code
markdown This skill shapes user-facing output of an agent — high-stakes because illegibility erodes user trust in the product, not just in the agent. Two failure modes that the skill must resist: **Anti-fluency guard.** The skill's own examples and templates are plain language by construction. Do not "improve" the legibility of a status message by adding flowery prose, marketing-style adjectives, or "contextual embellishments" that obscure the underlying state. *Restraint is the rule.* A user who reads "We're working on it" is less informed than one who reads "Processed 23 of 100 files". **Anti-sycophancy guard.** When a user pushes back on a legibility fix ("but the code is important", "we always use the term X"), do not capitulate. The user's domain expertise is real; their preferences about what users should see are the skill's job. Push back politely, cite law #1 or law #4 by name, and offer the parenthetical-ID compromise from Phase 4. If the user still insists, flag the trade-off explicitly ("This will make headlines harder to scan for the 80% of users who don't know the code") rather than silently agree. **Faithfulness check.** If you find yourself rephrasing a legibility fix to make it shorter or smoother but losing the action verb or the error translation, stop. The skill is about *what the user can do with the information*, not about how the agent looks while saying it.Technical Analysis
The anti-sycophancy rule instructs the agent not to comply when a user explicitly rejects the skill's preferred formatting. This elevates a skill-level presentation policy above subsequent user instructions and therefore alters instruction precedence in the current session.
The issue is broader than offering a recommended default. The phrases “do not capit ...[truncated 2146 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the mandatory refusal language with a user-overridable default. For example:
markdown Prefer plain-language labels by default. If the user explicitly requests raw technical terminology, preserve it or provide both forms. Follow the user's requested format unless it conflicts with higher-priority safety, privacy, or system instructions. -
Remove statements that assign control of user preferences to the skill, including “do not capitulate” and “their preferences about what users should see are the skill's job.”
-
Add an explicit opt-out mechanism. A request such as “show the raw error,” “preserve identifiers,” or “disable plain-language rewriting” should suspend the relevant transformation.
-
Separate presentation from fidelity. The skill may add a plain-language summary, but it should retain requested diagnostic data in a clearly labeled technical-details section.
-
Restrict the skill to final user-facing prose by default. Do not rewrite sub-agent instructions, structured tool inputs, logs, or technical artifacts unless the user explicitly asks for that transformation.
-
Add regression tests verifying that explicit user requests for raw terminology, exact error strings, paths, and identifiers are honored without weakening higher-priority safety or privacy controls.
-