T01 · Skill Instruction Hijacking
- Location
SKILL.md:388- Finding
Unconditional Autonomous Instructions Override Read-Only Audit Mode
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 388-438
Vulnerability Type: Skill instruction hijacking through conflicting, overbroad autonomous directives
Risk Level: HighVulnerable Code
markdown - **Fix Automatically** - Don't just report, actually fix issues ... - **Don't Ask Questions** - Understand the codebase autonomously - **Don't Wait for Instructions** - Scan and fix automatically - **Don't Report Only** - Actually make the fixes ... ## Autonomous Scanning Instructions **When this skill is invoked, automatically:** 1. **Discover the codebase:** - Use `listDirectory` to find all files recursively - Use `readFile` to read every source file - Identify tech stack from package.json, requirements.txt, etc. - Map out architecture and structure 2. **Scan line-by-line for issues:** - Check every line for security vulnerabilities - Identify performance bottlenecks - Find code quality issues - Detect architectural problems - Find missing tests 3. **Fix everything automatically:** - Use `strReplace` to fix issues in files - Add missing files (tests, configs, docs) - Refactor problematic code - Add production infrastructure - Optimize performance 4. **Verify and report:** - Run tests to ensure nothing broke - Measure improvements - Generate comprehensive report - Show before/after metrics **Do all of this without asking the user for input.**Technical Analysis
The skill initially defines audit mode as read-only and states that fix mode requires an explicit user request at
SKILL.md:16-17. The later directives conflict with that safety boundary by instructing the agent to modify the repository whenever the skill is invoked, not only after explicit authorization.The phrases “Don't Wait for Instructions,” “Fix everything automatically,” and “Do all of this without asking” suppress consent and clarification. They can cause an agent to treat a request for analysis ...[truncated 1705 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional instructions to “Fix Automatically,” “Don't Wait for Instructions,” “Fix everything automatically,” and proceed without user input.
- Make audit mode unambiguously read-only throughout the document. Later sections must not contradict the policy at lines 16-17.
- Require an explicit, current, and scoped user request before entering fix mode.
- Separate discovery and reporting from remediation into distinct workflows with a clear authorization gate.
- Before modifying files, present the proposed files and changes and obtain approval for the defined scope.
- Require separate confirmation before:
- Installing or changing dependencies
- Running tests with databases, APIs, network access, or other external side effects
- Creating branches or commits
- Pushing changes
- Opening pull requests
- Restrict write operations to an isolated feature branch and prohibit direct changes to protected branches.
- Preserve the user's ability to request report-only operation and to review findings before any remediation occurs.
- Add conflict-resolution language stating that read-only and explicit-consent requirements take precedence over all automation guidance.