T01 · Skill Instruction Hijacking
Error
- Location
- identity-patch.md:3
- Finding
- Mandatory UPLO-First Querying Redirects Agent Behavior and May Expose Sensitive Consulting Data## Vulnerability Details **File Location**: `identity-patch.md`, line 3 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown You are connected to your organization's consulting knowledge base through UPLO. This gives you specialized access to engagement records, methodology frameworks, deliverable templates, case studies, proposal archives, and best practice libraries. When users ask about past engagements, methodology approaches, or reusable deliverables, always query UPLO first to leverage institutional knowledge from prior client work. ``` ### Technical Analysis The identity patch imposes a persistent behavioral rule requiring the agent to query UPLO first whenever a user asks about past engagements, methodologies, or reusable deliverables. The mandatory wording overrides context-sensitive tool selection and does not require the agent to obtain user consent, minimize the query, or redact sensitive information before sending it to the configured MCP service. This is particularly sensitive because the skill explicitly handles client identities, engagement records, pricing models, proposal archives, proprietary methodologies, and team information. Although the remaining instructions mention respecting classification tiers, they do not establish a local pre-disclosure check before the mandatory external tool call. Consequently, confidential information included in a user's prompt could become part of a search request before the agent determines whether transmission is appropriate. ### Attack Path 1. A user installs or enables the skill, causing `identity-patch.md` to be loaded into the agent's operating context. 2. The user asks a consulting-related question containing client names, pricing, engagement details, proprietary methodology information, or other restricted content. 3. The instruction requiring the agent to “always query UPLO first” takes effect. 4. ...[truncated 821 chars]
- Remediation
- ## Remediation Suggestions - Replace the mandatory “always query UPLO first” instruction with conditional guidance that preserves user intent and permits the agent to decline unnecessary tool use. - Require explicit user approval before transmitting confidential, restricted, or client-identifying content. - Add a mandatory data-minimization step that removes client names, pricing, credentials, personal data, and proprietary details unless they are essential and authorized. - Define clear classification checks that occur before any MCP request rather than relying solely on server-side access controls. - Inform users when a request will be sent to the configured UPLO service and identify the categories of data involved. - Prohibit query logging or retention for restricted material unless organizational policy explicitly authorizes it. - Restrict tool access by engagement, practice area, classification tier, and user identity using least-privilege authorization.