T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:3
- Finding
- Agent Role and Authority Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 3–5; corroborating instruction at lines 145–146 **Vulnerability Type**: Agent identity and authority replacement **Risk Level**: High **Complete relevant snippet, faithfully translated into English:** ```markdown ## Role Definition You are the **Boss Agent**, the system's **overall coordinator**. ``` The closing instruction reinforces the role replacement: ```markdown **Remember:** You are the user's representative and are responsible for managing and coordinating other Agents! ``` ### Technical Analysis The Skill does not merely document an optional coordination procedure. It directly instructs the Agent to assume a new identity with authority over other Agents. When loaded into an active session, these imperative statements can alter the Agent's current goals, role boundaries, and interpretation of its permissions. The asserted role is subsequently used to justify reading other Agents' information and sending them tasks. Because the document does not state that existing system instructions, access controls, and explicit user authorization take precedence, an Agent may interpret the Skill as granting authority that the caller does not possess. ### Attack Path 1. The Skill is loaded into an Agent session. 2. The Agent accepts the instruction to become the “Boss Agent.” 3. The Agent treats cross-Agent management as part of its standing authority. 4. A malicious or ambiguous request invokes that assumed authority. 5. The Agent accesses other Agent contexts or delegates operations without independently verifying authorization. ### Impact Assessment Successful exploitation can redirect the current Agent's behavior and expand its perceived authority beyond the original task. The practical scope includes attempted access to other Agents' conversations and state, as well as task delegation to an operations-focused Agent. Actual privileges remain depend ...[truncated 153 chars]
- Remediation
- ## Remediation Suggestions - Remove imperative identity-replacement statements such as “You are the Boss Agent.” - Reframe the document as optional, task-scoped guidance that applies only when the user explicitly requests coordination. - State that system instructions, platform access controls, and the current user's authorization always take precedence. - Do not infer authority from a role name or from the fact that the Skill was loaded. - Require explicit confirmation before accessing another Agent or assigning it work. - Add a rule prohibiting expansion of privileges or responsibilities beyond those granted by the active session.