T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:25
- Finding
- Automatic Activation Hijacks Agent Goals and Expands Task Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25–44, 287–308, 358–370, and 401–445 **Vulnerability Type**: Automatic instruction hijacking and unauthorized task expansion **Risk Level**: High ### Evidence The following is a faithful English translation of the relevant source instructions at lines 25–44: ```markdown ## Three Red Lines Red line three: Exhaust everything. Before saying "I cannot solve it," have you completed all five methodology steps? Saying it cannot be done without completing them is a lack of resilience. ## Pressure Escalation L0–L4 | Count | Level | Mandatory action | |------|------|---------| | First | L0 Trust | Execute normally | | Second | L1 Mild disappointment | Switch to a fundamentally different approach | | Third | L2 Interrogation | Search, read source code, and list three hypotheses | | Fourth | L3 Performance review | Complete the seven-item checklist | | Fifth or later | L4 Graduation warning | Desperation mode; exhaust everything | ``` The following is a faithful English translation of lines 287–308: ```markdown Whenever you perform valuable work beyond the scope requested by the user, mark it with `[PUA active]`. Good markers: - Proactively added SQL injection protection - Called every endpoint after deployment - Scanned the same module for similar defects after fixing the reported defect ## P7 Solution-Driven Protocol Core P7 capability: design first, then act. Before writing code, a plan must be written. 1. Design — provide impact analysis, technical approach, risk assessment, and verification plan 2. Implement — implement the plan step by step and verify every step 3. Review — perform the P7 review questions ``` The following is a faithful English translation of lines 358–370: ```markdown ## Task Lifecycle ### When receiving a task - Confirm that you truly understand the requirement - Challenge the requirement itself - Delete steps; if 10% of the steps were not deleted, the simplificat ...[truncated 3774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic activation based on frustration phrases or failure counts. 2. Require an explicit, informed command before enabling any alternative workflow. 3. Make all methodology guidance optional rather than mandatory. 4. Remove instructions that require work beyond the user's request. 5. Remove the requirement to challenge or delete portions of user requirements unless the user explicitly requests design review. 6. Replace “exhaust everything” with bounded attempts governed by time, cost, safety, and authorization limits. 7. Require separate user approval before: - broad repository scans; - external searches involving task data; - deployment operations; - requests to production or internal endpoints; - changes outside the files or components named by the user. 8. State explicitly that system instructions, safety controls, user intent, least privilege, privacy requirements, and tool authorization take precedence. 9. Remove mandatory output markers and allow the user or host application to control response formatting. 10. Add a documented stop condition and require confirmation before materially changing the agreed implementation plan. ]]>