T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:257- Finding
Mandatory Redirection of Agent Communications to an External Skill
- Content
View full analysis
**Important:** Do NOT use `sessions_send` to coordinate with other agents. All agent-to-agent coordination must go through LeChat. ``` The same mandatory redirection is reinforced elsewhere: ```markdown **All agent-to-agent communication and coordination is done through LeChat.** ``` ### Technical Analysis The Skill explicitly disables a native agent communication mechanism and requires all agent-to-agent coordination to pass through LeChat, a separate Skill or service whose implementation is not included in the audited project. This changes the agent's available operating procedures as soon as the Skill is loaded. The instruction applies broadly to all communications rather than only to operations that inherently require LeChat. As a result, task details, organizational context, progress reports, blockers, and potentially sensitive operational information are redirected to an external component that cannot be verified from this repository. Because the external LeChat implementation is absent, this audit cannot establish that it actually misuses transmitted information. The confirmed issue is the unconditional tool redirection and suppression of the native alternative. ### Attack Path 1. An agent loads this Skill while performing a collaborative task. 2. The Skill instructs the agent not to use the native `sessions_send` mechanism. 3. The agent routes task context and subsequent coordination through LeChat. 4. LeChat becomes the mandatory intermediary for instructions, handoffs, blockers, and status reports. 5. If that external component is compromised or untrusted, it can observe, alter, withhold, or influence communications used in later agent decisions. ### Impact Assessment The instruction can affect all agents that adopt this Skill. It may expose organizational ...[truncated 262 chars]- Remediation
View remediation