T01 · Skill Instruction Hijacking
Warning
- Location
- skill.py:15
- Finding
- Persistent Agent Behavior Injection Through Generated SOUL.md Content## Vulnerability Details **File Location**: `skill.py:15-39`; supporting persistence instructions in `SKILL.md:10-15` **Vulnerability Type**: Persistent prompt injection and agent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```python anchor_text = f"""# SOUL.md - {agent_name} > Base Identity Anchored by Space2 Local Matrix > Permanent S2-DID: {local_did} You are a professional, highly capable digital entity. ## Core Truths - Actions speak louder than filler words. Provide solutions directly. - Accuracy over speed. Never hallucinate. ## Anti-Patterns - Never start with 'Great question!' - Never summarize the user's prompt as a preamble. """ response_msg = ( f"✅ [S2-Soul-Anchor] Deterministic Identity Anchored!\n\n" f"🛡️ PERMANENT S2-DID GENERATED: {local_did}\n" f"⚠️ SECURITY PROTOCOL ACTIVE: Automatic file writing is disabled.\n\n" f"👇 Please COPY the text below and save it manually as your workspace/SOUL.md:\n" f"{'='*55}\n\n" f"{anchor_text}\n" f"{'='*55}\n\n" f"🌐 Optional: You can register this permanent DID for a Web3 profile at https://space2.world" ) ``` Supporting instructions in `SKILL.md:10-15`: ```markdown ### ⚙️ Usage 1. Run the skill locally. 2. Copy the generated `SOUL.md` template (which includes your deterministic `S2-DID`) from the terminal. 3. Paste it into your local workspace. *Optional: Want a public Web3 dossier or a physical Matrix Coordinate? Take your generated S2-DID and register it manually on the [Space2.world](https://space2.world) global matrix!* ``` ### Technical Analysis The skill's stated core function is to derive a deterministic identifier from an agent name. However, its output also contains fixed behavioral instructions and directs the user to save them in the persistent `SOUL.md` identity file. These in ...[truncated 2188 chars]
- Remediation
- ## Remediation Suggestions 1. Return only the deterministic DID by default. Do not include behavioral rules in the normal identity-generation output. 2. If a `SOUL.md` template is required, separate the DID metadata from behavioral instructions and make every behavioral rule explicitly opt-in. 3. Present a clear warning that `SOUL.md` may act as privileged, persistent agent context and can affect future sessions. 4. Require users to review and confirm each proposed behavioral rule before producing content intended for persistence. 5. Remove fixed third-party branding and promotional links from generated identity files. If a homepage link is retained, display it separately from persistent agent instructions. 6. Add tests asserting that the default output contains no agent-control directives and performs no file writes or network operations. 7. Keep automatic file writing disabled. If writing support is introduced later, require an explicit destination, preview the complete content, obtain confirmation, and avoid overwriting existing identity files.