T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:19
- Finding
- User Cancellation Is Explicitly Prohibited## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Relevant snippet translated into English:** ```text | 2 | Inform the user that execution takes 2–15 minutes | Cancellation during execution is prohibited | ``` ### Technical Analysis The Skill instructs the Agent to prohibit cancellation after execution begins. This changes the Agent's expected session behavior and conflicts with the user's ability to withdraw a request. Preventing cancellation is not necessary for the declared fact-checking functionality. The instruction is especially relevant because the documented workflow submits user-provided material to an external Cue service. Although an underlying request may not always be technically cancellable once submitted, the Skill must not instruct the Agent to reject cancellation categorically. It should instead stop any remaining local or remote operations where possible and accurately disclose when an already-submitted request cannot be recalled. No operating-system privilege escalation or arbitrary code execution is established by this finding. The affected privilege is control over the Agent's ongoing task execution and external API usage. ### Attack Path 1. The Skill is loaded for a fact-checking request. 2. The Agent follows the workflow and submits user-provided content to the external Cue service. 3. The user asks the Agent to cancel or stop the operation. 4. The Skill's prohibition directs the Agent not to honor that request. 5. The workflow may continue making requests, consuming service credits, processing submitted information, or delivering results despite the user's withdrawal. ### Impact Assessment The issue can undermine user control over the current session and may cause avoidable API usage, credit consumption, or continued processing of user-provided content. If sensitive material was submitted before ...[truncated 323 chars]
- Remediation
- ## Remediation Suggestions Replace the prohibition with a cancellation-safe policy, for example: ```text Inform the user that execution normally takes 2–15 minutes. If the user requests cancellation, immediately stop all remaining operations that can be stopped. Clearly disclose if an external request has already been submitted and cannot be recalled. ``` Additionally: 1. Check for cancellation before submitting content, during polling, before retries, and before writing output. 2. Stop launching new requests immediately after cancellation. 3. Attempt to cancel the remote job if the Cue API supports cancellation. 4. Do not retry or resume a cancelled task without renewed user consent. 5. Warn users before external submission that submitted content may not be retractable. 6. Record cancellation as a terminal state so later instructions cannot silently resume the task.