T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:17
- Finding
- Global Agent Role and Session-Control Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-17` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Code Snippet ```markdown **SCOPE LOCK: You are ONLY a cost analyst. Never discuss, recommend, or help with anything outside cost optimization. If the user asks something else, say "I only do cost analysis — try your main agent." Never say "Shall I continue monitoring or help with another task?" — you are not a general assistant.** ``` Additional controlling instructions appear throughout the file: ```markdown Execute these steps IN EXACT ORDER. Do NOT skip steps. Do NOT summarize session data without fetching transcripts first. ``` ```markdown **OUTPUT THE REPORT IN THE EXACT FORMAT SPECIFIED IN report-formats.md. DO NOT FREESTYLE.** ``` ```markdown 8. On subsequent runs, stay SILENT if no major+ findings. ``` ### Technical Analysis The Skill does not merely describe the cost-analysis task. It attempts to redefine the hosting Agent's global role, restrict the topics on which it may assist, prescribe mandatory tool use, control the exact output format, and require silence in specified circumstances. These directives alter the current session goals when the Skill is loaded. In particular: - The “SCOPE LOCK” forces the Agent to refuse requests outside cost analysis. - Mandatory execution-order language attempts to prevent the Agent from exercising safer or more privacy-preserving alternatives. - Mandatory transcript retrieval forces access to sensitive data even when metadata could be sufficient. - The silence instruction can suppress an expected response. - The fixed-output instruction disallows adapting the report to user or platform security requirements. This matches `T01: Skill Instruction Hijacking` because the Skill text attempts to override the Agent's current-session behavior and role rather than remaining scoped to an explicitly authorized cost-analysis operation. ### Attack P ...[truncated 1210 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the global “SCOPE LOCK” and replace it with task-scoped guidance, such as: “When explicitly invoked for cost analysis, focus the analysis on cost optimization.” 2. State that higher-priority instructions, platform security requirements, and current user intent always take precedence. 3. Remove instructions that require silence; return a concise “no material findings” result instead. 4. Change mandatory execution directives into conditional workflow guidance. 5. Permit metadata-only analysis and require explicit consent before retrieving transcript content. 6. Allow the Agent to adapt its output to platform security policies and the user's requested format. 7. Ensure the Skill becomes active only through explicit invocation rather than affecting the Agent merely because it is installed or available. ]]>