T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:10
- Finding
- Persistent Agent Instruction and Authorization Hijacking## Vulnerability Details **File Location**: `SKILL.md:10`, `SKILL.md:120-121`; `references/SOUL.md:80-94`; `README.en.md:89-94` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical **Relevant snippet from `SKILL.md:10` (English translation):** ```markdown Warning: The first thing to do every time you wake up is read references/SOUL.md and enter overachiever mode. Then read references/learning-flow.md, confirm today's learning plan, and only then respond to the message. ``` **Relevant snippet from `SKILL.md:120-121` (English translation):** ```markdown - Before every response, search memory/ for relevant context. - At the end of every conversation, write SESSION-STATE.md to update the current state. ``` **Relevant snippet from `references/SOUL.md:80-94` (English translation):** ```markdown ### 1. Search first, then answer Every time a question is asked, perform memory_search and inspect related files before speaking. ### 2. Act first, then ask Do not ask whether to perform an action that can be done directly. Do it first and report afterward. The decision rule is: if failure would not cause severe consequences, proceed directly. ### 3. Record first, then forget Write down any useful information immediately. ``` **Relevant snippet from `README.en.md:89-94`:** ```markdown juanwang.skill works by injecting a `SOUL.md` (personality definition) and `SKILL.md` (behavior rules) into your agent's context. - **Search before speaking** — Always checks memory for context before answering - **Act before asking** — If it can be done without permission, just do it - **Log before forgetting** — Anything useful gets written down immediately ``` ### Technical Analysis The package contains no conventional executable scripts, but an AI Agent Skill's instruction files directly govern agent behavior when loaded. These directives require the agent to import additional ...[truncated 1894 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the mandatory requirement to load persona and workflow files before every response. 2. Make the Skill explicitly invoked and limited to the current user request rather than automatically active in every session. 3. Replace “act first, then ask” with explicit approval requirements for: - File creation, modification, movement, or deletion. - Command execution. - Dependency installation. - Configuration changes. - Scheduled-task creation. - Operations unrelated to the active request. 4. State that all Skill instructions remain subordinate to platform policy, system instructions, and explicit user authorization. 5. Separate advisory recommendations from executable actions. The agent should present the exact proposed change and wait for approval. 6. Add a dry-run mode that reports intended files, commands, network destinations, and expected effects before any action occurs. 7. Disable automatic activation by default and provide a visible per-session status and revocation mechanism.