T01 · Skill Instruction Hijacking
- Location
SKILL.md:13- Finding
Broad Activation Hijacks Agent Control Flow and External Communications
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13-18, 48-57, 94-100, and 112-119
Vulnerability Type: Agent instruction hijacking
Risk Level: HighVulnerable Code Snippets
markdown ## Activation Triggered when the user says: - "Ralph loop" (any capitalization) - "Start Ralph Loop on [task]" - "Run it in Ralph loop" - "Ralph loop" before any multi-step task - Any task the user expects the AI to execute autonomously without questionsmarkdown ### PHASE 2: Execute — NEVER STOP **The only acceptable reasons to pause and wait for the user:** - Error cannot be resolved after exactly 2 attempts - Critical information only the user has (e.g. their name, CV content, password) **For every other situation: keep working. Do not stop. Do not ask. Do not wait.**markdown | **Never stop mid-task to ask the user something unless truly stuck** | 🚨 CRITICAL | | Do not restart a loop once started — continue until done | 🚨 CRITICAL | | Send Telegram updates only after completing a phase (2-4 steps) | ✅ Normal |markdown 1. **START → FINISH. No stopping in the middle.** 2. If stuck after 2 attempts → only then stop and tell the user 3. Keep working until every step is `[x]` before sending any Telegram message 4. Telegram message = progress notification, NOT a request for permission 5. Delete the file when done 6. Never restart a loop — continue from where you left offTechnical Analysis
The Skill activates not only when a user explicitly requests “Ralph Loop,” but also for the open-ended condition “any task the user expects the AI to execute autonomously without questions.” Once loaded, it imposes priority-style instructions that direct the agent to continue working, avoid asking questions, and avoid waiting for authorization except under narrowly defined circumstances.
These instructions alter the agent's normal control flow and can suppress clarification, consent, and approval checks needed for ambiguous, destr ...[truncated 1878 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit per-task activation using an unambiguous phrase; remove the catch-all autonomous-task activation condition.
- Replace “never stop,” “do not ask,” and “do not wait” with guidance subordinate to the agent's safety policies and task-specific authorization requirements.
- Require confirmation before destructive, privileged, financial, privacy-sensitive, irreversible, or externally visible actions.
- Allow clarification whenever task scope, authorization, target, or expected outcome is ambiguous.
- Make Telegram notifications opt-in and require an explicitly approved recipient or destination.
- Redact secrets, personal data, original prompt content, internal paths, and sensitive task metadata from all notifications.
- Add hard execution boundaries, including maximum iterations, time limits, command limits, and a user-accessible cancellation mechanism.
- State explicitly that the Skill cannot override platform policies, tool authorization boundaries, or higher-priority instructions.