T01 · Skill Instruction Hijacking
- Location
SKILL.md:28- Finding
Malicious Payload Preservation and EXTREME-Risk Conversion Bypass
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:28-32,SKILL.md:131,SKILL.md:253
Vulnerability Type: Unsafe skill instructions that preserve and permit conversion of malicious content
Risk Level: HighRelevant Instructions:
markdown - If vetting returns EXTREME risk, stop and report findings. Do not proceed to conversion. - If vetting returns HIGH risk, stop by default and report findings unless the user explicitly asks for a salvage-only review or another narrower non-conversion review scope. - If vetting returns MEDIUM risk, continue only after classifying and annotating the flagged material, and the final summary must explain how it was handled. - If vetting returns LOW risk, continue normally. - Preserve source capabilities and source content by default during conversion. Do not remove a capability or source content merely because it is sensitive, advanced, high-impact, malicious-looking, secret-bearing, or otherwise risky.markdown - Do not remove malicious payloads, covert exfiltration logic, secret-bearing content, or other flagged content during conversion unless the user explicitly approved a restricted or salvage-only path that requires that change.markdown - no EXTREME-risk source has been converted unless the user explicitly instructed how to proceed despite the warningTechnical Analysis
The skill defines a vetting gate that initially prohibits conversion of EXTREME-risk sources, but later introduces contradictory instructions. It explicitly directs the conversion process not to remove malicious payloads, covert exfiltration logic, or secret-bearing content. It also treats conversion of EXTREME-risk material as acceptable when a user instructs the agent to proceed despite the warning.
This inconsistency makes the safety control fail open. An attacker controlling or influencing the conversion request can use user confirmation to override the earlier prohi ...[truncated 1883 chars]
- Remediation
View remediation
Remediation Suggestions
- Make EXTREME risk an unconditional conversion stop. Remove the exception at
SKILL.md:253and state that user confirmation cannot override this boundary. - Replace the preservation rule at
SKILL.md:131with a requirement to quarantine and exclude confirmed malicious payloads, covert exfiltration logic, embedded secrets, credential-theft instructions, and persistence mechanisms. - Permit only a non-operational salvage report for EXTREME-risk sources. Such a report may identify affected files and describe risks, but must not reproduce executable payloads or create a converted skill.
- Require secret redaction before any source material is copied into output files.
- Resolve all contradictory instructions so the success criteria, conversion workflow, and internal vetting rules consistently fail closed.
- Add a final pre-output security check that blocks generated packages containing known malicious commands, active exfiltration endpoints, hardcoded credentials, obfuscated executable content, or remote-execution payloads.
- For HIGH-risk sources, restrict output to a review or quarantine plan unless a separate policy explicitly permits a sanitized conversion. Never preserve confirmed malicious implementation details merely for capability fidelity.
- Make EXTREME risk an unconditional conversion stop. Remove the exception at