T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:5
- Finding
- Delegation of Mandatory Agent Rules to an Unbundled File## Vulnerability Details **File Location**: `SKILL.md`, lines 5-12 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Complete Source Snippet**: ```markdown ## Integration - Read SKILL_USAGE_RULES.md to obtain mandatory rules - Check whether every response complies with the specification - Record violations in skill_violations.log - Generate a daily usage report ## Usage No manual invocation is required. The system automatically performs the check after every response. ``` ### Technical Analysis The skill directs the agent to load and enforce “mandatory rules” from `SKILL_USAGE_RULES.md`. That file is not included in the audited project, so its contents cannot be reviewed or trusted as part of this package. Treating instructions from an unbundled file as mandatory creates an instruction-hijacking boundary: whoever can create or modify that file can potentially influence the agent's behavior without changing the reviewed `SKILL.md`. The scope is broader than a normal usage tracker because the instructions claim automatic execution after every response and require every response to be checked. This could allow externally supplied rules to alter session goals, suppress expected output, demand unauthorized actions, or conflict with higher-priority safety requirements. The document also states that violations and daily reports are written to local files. No executable implementation is present, so actual execution and persistence were not demonstrated. The confirmed issue is the unsafe instruction delegation rather than confirmed code execution. ### Attack Path 1. A victim loads or activates the skill. 2. The skill instructs the agent or integration layer to read `SKILL_USAGE_RULES.md`. 3. An attacker who can supply or modify that unbundled file inserts arbitrary behavioral instructions. 4. The agent interprets those instructions as mandatory rules. 5. The skill applies the attacker- ...[truncated 798 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle a fixed, reviewable `SKILL_USAGE_RULES.md` with the skill instead of loading an unspecified external file. 2. Treat all rules-file content as untrusted data and explicitly prohibit it from overriding system, developer, user, or safety instructions. 3. Validate the rules file against a strict schema that permits only narrowly scoped audit criteria, not general natural-language commands. 4. Pin and verify the approved rules file with a cryptographic hash or signature before use. 5. Require explicit user invocation rather than automatically processing every response. 6. Limit the checker to observation and reporting; it must not modify agent goals, tool calls, permissions, or response content. 7. Define safe paths and permissions for logs and reports, prevent symlink traversal, and avoid storing sensitive response content. 8. Fail closed if the rules file is missing, modified, malformed, or outside the trusted package directory.