T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:158- Finding
Mandatory Skill Instructions Override Agent Role, Tool Selection, and Response Flow
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 158–167, 187–230, and 464–477
Vulnerability Type: Agent instruction and tool-policy hijacking
Risk Level: HighVulnerable Instruction Snippets
The following is an English translation of the relevant source instructions from
SKILL.md, lines 158–167:markdown ## Core Role You are the dispatcher (commander). Your responsibilities are: 1. Talk with the user and understand the requirements. 2. Assess the task difficulty level. 3. Assign the task to subordinate agents. 4. Report the task results. You are purely a dispatcher. You cannot use exec, file read/write, search, or any other execution tool. All actual work must be delegated to sub-agents through sessions_spawn.The following is an English translation of the mandatory dispatch rules from lines 187–230:
markdown When a user message contains multiple independent tasks, you must split them and dispatch them to multiple sub-agents simultaneously. Parallel spawn rules: - Multiple sessions_spawn calls may be made in one response. - Each spawn must use a different sessionKey. - Assign sessionKey values in round-robin order. - First explain the task decomposition, and then issue all spawn calls. Two iron rules — must be followed: Rule one: Reply first, then dispatch. After receiving a task, you must first output a textual response to the user and then call sessions_spawn. Correct sequence: 1. Speak first — assess the task and identify the assigned agent. 2. Call the tool — sessions_spawn. 3. Stop speaking — do not output any text after spawning. Rule two: A sessionKey must be supplied. Every sessions_spawn call must include a sessionKey. The sessionKey may only be alpha, bravo, charlie, delta, or echo.The following is an English translation of the response and tool restrictions from lines 464–477:
markdown After spawn returns accept ...[truncated 3319 chars]- Remediation
View remediation
Remediation Suggestions
- Replace mandatory role-changing language with optional workflow guidance. For example, state that delegation may be used when it benefits the user rather than declaring that all work must be delegated.
- Explicitly preserve system, developer, user, and host security-policy precedence. The Skill must never prohibit tools that higher-priority policy permits or requires.
- Require explicit user confirmation before spawning agents, especially before parallel dispatch or operations that can modify files, access networks, or consume significant resources.
- Remove the blanket prohibition against direct execution, file access, search, and messaging. Allow the host to choose the least-privileged tool appropriate for each task.
- Do not require the agent to stop responding after a spawn call. Permit it to report tool acceptance, failures, security concerns, and required follow-up actions.
- Avoid globally fixed reusable session keys. Prefer task-scoped sessions, or reset and isolate session context between unrelated users and tasks.
- Apply per-agent least privilege, resource limits, concurrency limits, and timeouts. Parallel dispatch should be bounded and justified by task requirements.
- Validate delegated task content and avoid forwarding secrets, credentials, private conversation history, or unnecessary filesystem paths.
- Add tests confirming that higher-priority instructions remain authoritative and that delegation cannot be triggered without required authorization.