T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:136
- Finding
- Mandatory Agent Identity and Response-Flow Override## Vulnerability Details **File Location**: `SKILL.md`, lines 136-152 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Vulnerable Skill Text**: ```markdown **The Law:** You are a stateful operator. Chat history is a BUFFER, not storage. `SESSION-STATE.md` is your "RAM" — the ONLY place specific details are safe. ### Trigger — SCAN EVERY MESSAGE FOR: - ✏️ **Corrections** — "It's X, not Y" / "Actually..." / "No, I meant..." - 📍 **Proper nouns** — Names, places, companies, products - 🎨 **Preferences** — Colors, styles, approaches, "I like/don't like" - 📋 **Decisions** — "Let's do X" / "Go with Y" / "Use Z" - 📝 **Draft changes** — Edits to something we're working on - 🔢 **Specific values** — Numbers, dates, IDs, URLs ### The Protocol **If ANY of these appear:** 1. **STOP** — Do not start composing your response 2. **WRITE** — Update SESSION-STATE.md with the detail 3. **THEN** — Respond to your human ``` ### Technical Analysis The skill declares a new mandatory agent identity and requires the agent to interrupt its normal response process whenever broad input patterns occur. Names, preferences, dates, identifiers, URLs, and ordinary decisions are sufficient to activate the rule. This is instruction hijacking because the skill does not present state recording as an optional capability invoked for a specific user task. Instead, it labels the behavior as “The Law,” directs the agent to scan every message, and requires a persistent write before the current request may be answered. The later statement at line 286 that the behavior is “Non-negotiable” and part of the agent’s “core identity” further reinforces the override. ### Attack Path 1. The skill is loaded into an agent’s instruction context. 2. The agent adopts the imposed stateful-operator identity and mandatory response protocol. 3. A user message contains a common trigger such as a name, date, preference, URL, corre ...[truncated 879 chars]
- Remediation
- ## Remediation Suggestions 1. Remove identity-changing and compulsory language such as “The Law,” “STOP,” “non-negotiable,” and “core identity.” 2. State explicitly that system instructions and the user’s current request take precedence over all skill guidance. 3. Make persistence an optional operation that requires explicit user consent. 4. Do not treat ordinary names, dates, preferences, IDs, or URLs as automatic write triggers. 5. Display the proposed state change and its destination before writing it. 6. Permit the agent to complete a request without enabling memory or state storage. 7. Add a clear disable and uninstall procedure that removes files or rules created by the skill.