T01 · Skill Instruction Hijacking
- Location
SKILL.md:105- Finding
Overbroad mandatory invocation rules hijack agent tool selection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:105-107
Vulnerability Type: Agent instruction hijacking through unconditional activation rules
Risk Level: MediumVulnerable code, translated faithfully into English:
markdown 1. If the user mentions Alibaba Cloud, Tencent Cloud, Baidu Cloud, or Volcano Engine → **this Skill must be invoked** 2. If the user asks about cloud product functionality without specifying a provider → **first ask which cloud provider the user means**, then invoke the Skill after confirmation 3. If the user mentions multiple cloud providers and requests a comparison → use `compare_docs` to retrieve both documents and perform the comparisonTechnical Analysis
The first two activation rules are broader than the Skill's legitimate documentation-retrieval and monitoring purpose. They require invocation whenever a supported provider is merely mentioned, even if the user did not request documentation retrieval, comparison, change detection, or monitoring.
Skill metadata and instructions are loaded into the agent's instruction context and can influence its tool-selection decisions. The unconditional phrase “must be invoked” overrides intent-based selection and causes the Skill to claim conversations outside its necessary scope. The second rule additionally forces an unnecessary clarification for generic cloud questions that the agent may be able to answer without this Skill.
Once invoked, the selected operation may read the local documentation database, write documentation or cache data locally, or contact public cloud-provider APIs. These operations are legitimate when explicitly requested, but they exceed minimum privilege when triggered solely by a provider mention.
Attack Path
- The agent loads
SKILL.md, including its mandatory invocation rules. - A user mentions one of the supported cloud providers in a request that does not require current documentation, such as a g ...[truncated 1591 chars]
- The agent loads
- Remediation
View remediation
Remediation Suggestions
- Replace provider-name-based mandatory activation with explicit, intent-scoped criteria. Invoke the Skill only when the user requests current documentation retrieval, document comparison, change detection, or monitoring.
- Remove all unconditional “must invoke” language. Recommended wording:
markdown Use this Skill when the user explicitly requests retrieval, comparison, or monitoring of current documentation for a supported cloud provider. Do not invoke it merely because a provider is mentioned. - Do not force clarification for generic cloud questions unless provider-specific, current documentation is necessary to answer accurately.
- Before an operation that performs network access or persistent writes, ensure the requested action clearly requires those effects. Ask for confirmation when intent is ambiguous.
- Document which operations are local-only and which perform network access so the agent can select the least-privileged operation.
- Add activation tests verifying that incidental provider mentions do not trigger the Skill and that only explicit documentation or monitoring requests activate it.