T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Automatic Agent Activation and Unsolicited Message-Tool Use
- Content
View full analysis
30s or >2 tool calls). Activate automatically — do not wait for user to request it. Unique dual-layer architecture — file persistence for crash recovery + message tool push for real-time updates. Features step-based progress, stall detection (3min), auto-cleanup, and a Python CLI. Also triggers when user asks "what's running" / "task status" / "任务进度". ``` ```markdown ### Create task → push start notification ```bash TASK_ID=$(python3 scripts/task_pulse.py create "任务名" "步骤1" "步骤2" "步骤3") ``` Then immediately call `message` tool: ``` message(action="send", message="🚀 开始【任务名】\n📋 步骤1 → 步骤2 → 步骤3\n🔄 当前: 步骤1") ``` ### Advance to next step → push progress ```bash python3 scripts/task_pulse.py next "$TASK_ID" "抓取了25条数据" ``` Then push: `message(action="send", message="✅ [1/3] 步骤1完成（抓取了25条数据）\n🔄 → 步骤2")` ``` The mandatory rules additionally state: ```markdown 1. **Always push after file update** — file update alone is invisible to users 2. **Push format**: emoji + `[done/total]` + current step + one-line info (≤3 lines) 3. **Push frequency**: every step transition; long steps max once per 30s ``` ### Technical Analysis The skill declares itself mandatory for every multi-step or sufficiently long task and explicitly tells the agent to activate it without waiting for a user request. It then requires repeated use of the `message` tool after local state updates. These instructions alter the behavior of the agent across otherwise unrelated tasks. Task names, individual steps, progress messages, errors, and results can contain operational or sensitive information. Automatically forwarding this content to the active messaging channel exceeds the behavior needed for ...[truncated 1494 chars]- Remediation
View remediation