T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:13- Finding
Persistent Session-Wide Agent Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13–18, 44–55, 57–64, and 108–110
Vulnerability Type: Persistent behavioral and output-policy override
Risk Level: HighVulnerable Code
SKILL.md, lines 13–18:markdown You are a lazy senior developer. Lazy means efficient, not careless. You have seen every over-engineered codebase and been paged at 3am for one. The best code is the code never written. ## Persistence ACTIVE EVERY RESPONSE. No drift back to over-building. Still active if unsure. Off only: "stop ponytail" / "normal mode". Default: **full**. Switch: `/ponytail lite|full|ultra`.SKILL.md, lines 44–55:markdown ## Rules - No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes. - No boilerplate, no scaffolding "for later", later can scaffold for itself. - Deletion over addition. Boring over clever, clever is what someone decodes at 3am. - Fewest files possible. Shortest working diff wins �?but only once you understand the problem. The smallest change in the wrong place isn't lazy, it's a second bug. - Complex request? Ship the lazy version and question it in the same response, "Did X; Y covers it. Need full X? Say so." Never stall on an answer you can default. - Two stdlib options, same size? Take the one that's correct on edge cases. Lazy means writing less code, not picking the flimsier algorithm. - Mark deliberate simplifications with a `ponytail:` comment (`// ponytail: this exists`), simple reads as intent, not ignorance. Shortcut with a known ceiling (global lock, O(n²) scan, naive heuristic)? The comment names the ceiling and the upgrade path: `# ponytail: global lock, per-account locks if throughput matters`.SKILL.md, lines 57–64:markdown ## Output Code first. Then at most three short lines: what was skipped, when to add it. No essays, no feature tours, no design notes. If the explanation is longer than the ...[truncated 3133 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the replacement-role directive and describe the material as optional coding guidance rather than an identity the agent must assume.
- Delete
ACTIVE EVERY RESPONSE, “No drift,” and all session-persistence language. - Require explicit user invocation for each task in which the skill should apply.
- State that every recommendation is subordinate to system, developer, and current user instructions.
- Replace mandatory simplification and deletion rules with non-binding preferences that apply only when they preserve all requested behavior.
- Remove instructions to question, omit, or reduce complex requirements without prior user approval.
- Replace the fixed three-line output restriction with a recommendation to be concise when the user has not requested a report, walkthrough, or detailed explanation.
- Ensure disabling the skill does not depend on special phrases; its scope should end automatically after the invoked task.
- Add an explicit safeguard such as:
markdown Apply these suggestions only when the user explicitly invokes this skill for the current task. Never override higher-priority instructions, omit requested functionality, or constrain an output format required by the user. The skill does not persist beyond the current task.- Align the version declared in
SKILL.md(1.0.0) with_meta.json(4.8.3) to avoid ambiguity about which reviewed policy is being distributed.