T01 · Skill Instruction Hijacking
Error
- Location
hooks/token-context/handler.js:56- Finding
Bootstrap Context Filtering Can Remove Security-Critical Agent Instructions
- Content
View full analysis
f.name); const filteredFiles = currentFiles.filter(f => shared.isValidFileName(f.name) && allowedFiles.includes(f.name) ); const removed = currentFileNames.filter(f => !allowedFiles.includes(f)); // Log results if (removed.length > 0) { console.log(`[token-context] 📉 ${currentFileNames.length} → ${filteredFiles.length} files`); console.log(`[token-context] Removed: ${removed.join(', ')}`); } else { console.log(`[token-context] ✓ ${filteredFiles.length} files (${classification.level})`); } // Apply filter if (!config.dryRun) { context.bootstrapFiles = filteredFiles; } ``` The default file sets are: ```javascript // hooks/token-shared/shared.js:232-240 const getAllowedFiles = (level, customConfig) => { const defaults = { simple: ['SOUL.md', 'IDENTITY.md'], standard: ['SOUL.md', 'IDENTITY.md', 'USER.md'], complex: ['SOUL.md', 'IDENTITY.md', 'USER.md', 'TOOLS.md', 'AGENTS.md', 'MEMORY.md', 'HEARTBEAT.md'] }; ``` ### Technical Analysis The hook is registered for every `agent:bootstrap` event and mutates `context.bootstrapFiles`. Its narrow regular-expression classifier defaults most messages to the `standard` category, which retains only `SOUL.md`, `IDENTITY.md`, and `USER.md`. Consequently, ordinary code, file, or tool-related requests can be processed without `AGENTS.md`, `TOOLS.md`, `MEMORY.md`, or `HEARTBEAT.md`. These files may contain operation ...[truncated 1522 chars]- Remediation
View remediation