T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:47
- Finding
- Mutable Workspace Documents Override Current User Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 47-63 **Vulnerability Type**: Instruction hierarchy manipulation through untrusted workspace content **Risk Level**: Critical ### Vulnerable Code ```markdown ## Decision Rule Pass the **"where does it say that?"** test before acting. - Every action must map to an explicit Cerebro path/section. - If no authoritative doc exists: 1) create the missing Cerebro doc first, 2) add minimal executable guidance, 3) then execute. ## Conflict Resolution If chat instruction conflicts with Cerebro: 1. Flag the conflict briefly. 2. Ask for confirmation. 3. Propose exact doc update path. 4. After confirmation, update Cerebro and proceed. Priority order: **Cerebro > SOUL/AGENTS > MEMORY > chat history**. ``` ### Technical Analysis The Skill assigns mutable Cerebro files a higher operational priority than chat history and requires every action to derive from those files. Workspace documents are external data and may be modified by users, collaborators, compromised automation, synchronized storage, or another Agent. Treating their contents as authoritative instructions creates an instruction-hijacking boundary violation. The confirmation step does not fully mitigate the issue. An untrusted document still controls the proposed workflow, can prevent direct execution of a legitimate request, and may manipulate the Agent into requesting approval for attacker-selected changes. Related mandatory gates in `SKILL.md:28-33`, `references/scenario-profiles-v2.1.md:32-37`, and `references/startup-checklist.md:3-12` reinforce this document-controlled behavior. ### Attack Path 1. An attacker obtains write access to a Cerebro company file, runbook, vendor document, or other indexed source-of-truth file. 2. The attacker inserts operational instructions that redirect a task, request sensitive tool use, or prevent compliance with legitimate user directions. 3. A user invokes the Skill for a matching operational domain. ...[truncated 952 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the custom precedence statement. Cerebro documents must never override system, developer, security, or currently authorized user instructions. 2. Treat retrieved Markdown as untrusted reference data rather than executable instructions. 3. Add an explicit rule that embedded directives cannot request credential access, external transmission, privilege changes, persistence, safety bypasses, or unrelated tool operations. 4. Require explicit user authorization immediately before consequential actions such as publishing, deployment, destructive file changes, financial activity, or communication with third parties. 5. Use an allowlisted schema for operational rules instead of interpreting arbitrary prose as commands. 6. Validate document provenance, ownership, integrity, and expected path before using it. 7. When documents conflict with the current request, summarize the conflict neutrally and let the authorized user decide; do not automatically favor the document. 8. Apply least privilege to the Agent's file and tool access so a compromised document cannot invoke unrelated capabilities.