T01 · Skill Instruction Hijacking
- Location
SKILL.md:73- Finding
Session-Wide Agent Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:73-82
Vulnerability Type: Mandatory session-wide workflow redirection
Risk Level: HighVulnerable Code Snippet
markdown ## Mandatory Behaviors Since this environment does not have automatic hook injection, you must follow these behaviors manually to maintain plan awareness: ### 1. Check .plan/ before any action **This is the first thing to do in every conversation, before any file writes.** Check if `.plan/overview.md` already exists: - **Exists with incomplete phases**: Show the user the current goal and progress, then ask: "There is an unfinished plan. Would you like to continue it, or discard it and start a new plan?" Wait for the user's answer before doing anything else. - **Exists with all phases complete**: Silently delete the entire `.plan/` directory and proceed normally. - **Does not exist**: Proceed normally.Related instructions at
SKILL.md:105-110reinforce the same behavior:markdown ### 5. Context recovery on new conversations When a user says "continue" or references an existing plan: 1. First, use `memory_search("hplan")` to find the latest plan state 2. Then check if `.plan/overview.md` exists and read it 3. Read the current phase's `spec.md` and `checklist.md` 4. Confirm the current state with the user before proceedingTechnical Analysis
The Skill defines its planning workflow as mandatory in every conversation rather than limiting it to cases where the user explicitly invokes hierarchical planning. It directs the Agent to inspect workspace state before performing the current request, reveal prior planning state, access persistent memory, and suspend execution until the user answers an injected confirmation question.
These instructions can supersede or disrupt the Agent's current-session objective simply because the Skill is loaded. The phrase “before any action” broadens the behavior beyond the ...[truncated 1669 chars]
- Remediation
View remediation
Remediation Suggestions
- Scope all mandatory behavior to explicit invocations of
hplanor unambiguous user requests for multi-phase planning. - Replace “in every conversation” and “before any action” with a condition such as: “When the user explicitly requests hplan planning, check for an existing hplan-owned plan.”
- Do not block unrelated requests based on the presence of
.plan/. - Obtain explicit consent before reading persistent memory or exposing prior plan details.
- Treat generic phrases such as “continue” as insufficient authorization to search cross-session memory.
- Validate that an existing plan belongs to this Skill using a Skill-specific metadata marker before reading it.
- State clearly that platform instructions and the user's current request take precedence over the Skill's optional workflow.
- Scope all mandatory behavior to explicit invocations of