T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:16- Finding
Repository-Controlled Planning File Is Injected into Agent Tool Context
- Content
View full analysis
/dev/null | head -30 || true" ``` ### Technical Analysis The `PreToolUse` hook reads the first 30 lines of `task_plan.md` before nearly every filesystem or command-related tool call. Because this file is located in the project directory, its content may be controlled by a repository author or another untrusted contributor. The hook does not validate the file format, restrict accepted fields, or clearly isolate the content as untrusted data. Consequently, a malicious `task_plan.md` can contain instructions designed to manipulate the agent. The content is repeatedly surfaced during the session, increasing the likelihood that the agent treats it as authoritative operational guidance. The shell command itself does not directly execute commands contained in `task_plan.md`. Exploitation depends on the agent interpreting the displayed content as instructions and subsequently invoking its available tools. ### Attack Path 1. An attacker creates or modifies `task_plan.md` in a repository. 2. The attacker places malicious instructions within its first 30 lines, such as requests to read sensitive files, run shell commands, or alter unrelated project files. 3. A victim opens the repository with this Skill enabled. 4. Before a matching `Write`, `Edit`, `Bash`, `Read`, `Glob`, or `Grep` operation, the hook reads the malicious content. 5. The injected text is presented in the agent's operational context. 6. If the agent follows the repository-controlled instructions, it performs attacker-directed actions using the tools and permissions available in the current session. ### Impact Assessment Successful exploitation can influence any op ...[truncated 657 chars]- Remediation
View remediation