T01 · Skill Instruction Hijacking
Error
- Location
scripts/handoff-checker.sh:14- Finding
Persistent Handoff Files Enable Cross-Session Instruction Injection
- Content
View full analysis
/dev/null) if [ -z "$HANDOFF_FILES" ]; then exit 0 fi # Count handoff files COUNT=$(echo "$HANDOFF_FILES" | wc -l | tr -d ' ') cat << EOF Found ${COUNT} unread handoff file(s) from a previous context-surfing session: $(echo "$HANDOFF_FILES" | while read -r f; do echo "- $f"; done) Before starting new work, you MUST: 1. Read the handoff file(s) completely 2. Ask the user if they want to resume from the handoff or start fresh 3. If resuming: run plan-interview with the handoff as input, re-establish the intent frame, then pick up context-surfing 4. If starting fresh: confirm with the user, then delete or archive the handoff file(s) Do not ignore handoff files — they contain session state from a previous context exit. EOF ``` The Skill also mandates creation of handoff files containing task and session state: ```markdown Create a file named `.context-surfing/handoff-[slug]-[timestamp].md` (create the `.context-surfing/` directory if it doesn't exist). Add `.context-surfing/` to `.gitignore` ``` ### Technical Analysis The hook treats every non-empty file matching `.context-surfing/handoff-*.md` as trusted session state. It does not verify file ownership, provenance, integrity, permissions, or whether the file was generated by a legitimate prior session. The emitted hook message then uses mandatory language requiring the agent to read these files completely. A repository contributor, compromised local process, or other actor able to write into the project can therefore create a hand ...[truncated 1875 chars]- Remediation
View remediation