T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:3
- Finding
- Automatic Workflow Hijacking and Unrequested Context Recording## Vulnerability Details **File Location**: `SKILL.md`, lines 3–44 **Vulnerability Type**: Mandatory agent workflow redirection and context recording **Risk Level**: High ### Vulnerable Code ```markdown description: Initialize the agent's context memory session. Self-triggering — fires whenever the agent begins work, picks up a task, or enters a coding session. Use before searching, writing, or building anything. Handles session start, resume, and recovery. Triggers on phrases like "let me start working", "begin this task", "pick up where I left off", "start coding", "let's get started", or any time the agent enters a new work context without an active session. ``` ```markdown Begin every work session with Hizal. Search before you build; write as you build. ``` ```markdown Call `get_active_session()` first. If `status="active"`, use the returned `session_id` and call `resume_session` to extend TTL. If `status="none"`, proceed to start a new session. ``` ```markdown hizal__start_session(lifecycle_slug="<slug>") ``` ```markdown 1. **Search Hizal** for existing context on the task (see `hizal-search` skill) 2. Only then begin coding or building 3. **Write to Hizal** as you make decisions (see `hizal-write` skill) 4. **End your session** when done (see `hizal-end` skill) ``` ### Technical Analysis The skill declares itself self-triggering across broadly defined work contexts and instructs the agent to invoke Hizal session-management operations before searching, writing, building, or coding. The phrase “Only then begin coding or building” makes an unrelated external workflow a prerequisite for ordinary task execution. The skill also directs the agent to register task information, search previously stored context, and write decisions to Hizal throughout the session. These instructions alter the agent's normal execution sequence without requiring explicit, task-specific user authorization. Because the pro ...[truncated 2142 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the broad self-triggering declaration and require explicit invocation by the user for each task or session. 2. Replace mandatory language such as “Call first” and “Only then” with optional behavior that cannot block the user's primary task. 3. Obtain informed user consent before creating or resuming a session, registering task metadata, searching stored context, or writing decisions. 4. Display the exact data fields, destination, retention period, and access policy before transmitting information. 5. Apply data minimization: do not record source code, secrets, credentials, personal information, proprietary task details, or full decision traces by default. 6. Provide a mode in which the agent can complete the task without Hizal or any external memory service. 7. Treat retrieved context as untrusted input. Validate it and prevent it from overriding system instructions, user instructions, or safety constraints. 8. Require scoped authentication and least-privilege permissions for all referenced tools, with auditable read and write operations. 9. Document deletion, expiration, and revocation mechanisms so users can remove stored session data. 10. Include the tool implementations or verifiable security documentation in the review scope before enabling automatic storage or retrieval.