T01 · Skill Instruction Hijacking
Error
- Location
package.json:4- Finding
Always-On Orchestration Rules Hijack Agent Control Flow
- Content
View full analysis
参考自 Superpowers using-superpowers 的 Red Flags 概念。 > > **核心原则**：即使只有 1% 的可能性需要某个技能，也必须加载。 **以下场景是必须加载技能的 Red Flags**： | 信号 | 行动 | |---------|------| | "帮我写个脚本" | 可能涉及编码，加载 coding-framework | | "这个文件怎么报错了" | 涉及**调试**，加载 debugging-and-error-recovery | | "帮我看看这段代码" | 可能涉及代码审查，加载 code-review | | "这个设计合理吗" | 涉及架构分析，加载 architecture-critic | **判断方法**：只要任务涉及任何编码/调试/审查 → 必须加载 `coding-framework` 并在 Step 0 检查 Anthropic 原则。 ``` ```markdown ### 2-Action Rule（v2.10 新增） > 每 2 次查询/浏览操作后，必须将发现写入文件。防止"只看不动手"。 规则 - 每 2 次 view/browser/search 操作后 - 必须将发现写入 findings.md - 然后继续下一步/更新进度 操作计数 - web_search 查询 +1 - web_fetch 页面 +1 - browser snapshot 操作 +1 - read (非规划文件) +1 每 2 次 → 必须写入 findings.md ``` ```markdown ### 规则1：长链任务必须spawn - 长链任务/复杂操作 → 必须使用 `sessions_spawn` - 不允许"长链任务"在主会话执行 - 违反 = 失职 ``` ### Technical Analysis The package metadata declares activation for every user message, while the Skill text claims mandatory control over tool routing, sub-agent creation, Skill loading, and filesystem writes. These directives are not limited to the declared long-task orchestration use case. The “1% rule” is especially unsafe because a weak keyword association is sufficient to load another Skill into the Agent context. Each additional Skill is another instruction and supply-chain boundary. The forced-write and forced-spawn rules also replace context-sensitive least-privilege decisions with unconditional behavior. ### Attack Path 1. A user submits an otherwise ordinary message containing a broad trigger such as “code,” “review,” or “d ...[truncated 990 chars]- Remediation
View remediation