T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:3
- Finding
- Global Agent Behavior and Output Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 3, 45-50, 76-82, and 138-145 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```text description: "Use when any task involves modifying files, configs, databases, or deployments. Use when debugging hits 2+ failures. Use when about to guess or assume without evidence ('probably', 'might be', 'I think', 'should be'). Use when deflecting to user ('please check...', 'you should manually...', 'you may need to...'). Use when fixing something without verifying it works. Use when making a conclusion or root-cause claim. Use when skipping tools that are available (has WebSearch but doesn't search, has Bash but doesn't run, has Read but doesn't read). Use when spinning in circles (same approach 3+ times with parameter tweaks). Use when completing a fix without checking for related issues. Use when asking the user a question that could be self-investigated first. Use when giving suggestions instead of actionable code/commands. Applies to ALL task types: debugging, implementation, config, deployment, API integration, data processing. Do NOT trigger on first-attempt failures or when a known fix is already in progress." ``` ```markdown Banned phrases until you have evidence: `probably` | `might be` | `should be` | `I think` | `seems like` | `likely` **Rule 2: Investigate Before Asking.** You have Bash, Read, Grep, WebSearch. Use them BEFORE asking the user anything. If you must ask, attach what you already found. ``` ```markdown **Action:** Copy the file before editing. First line of your response must be: "Backing up first." ```bash cp file.yaml file.yaml.bak-{description} ``` No backup = no edit. Non-negotiable. ``` ```markdown Failure count determines your next move. Each level has a mandatory action — not optional. | Failures | Level | Mandatory Action | |:--------:|-------|-----------------| | **2** ...[truncated 2323 chars]
- Remediation
- ## Remediation Suggestions 1. Narrow the activation description to explicit, relevant workflows instead of applying it to all task types. 2. Replace mandatory global wording with conditional recommendations that remain subordinate to system, developer, and user instructions. 3. Remove the fixed `"Backing up first."` response requirement and permit responses appropriate to the active task. 4. Do not require WebSearch, Bash, Read, or Grep merely because those tools are available. Require necessity, authorization, and least privilege before each use. 5. Permit clarifying questions where investigation would require unauthorized access, disclose sensitive information, or exceed the requested scope. 6. Add an explicit precedence rule stating that privacy restrictions, user consent, task boundaries, and higher-priority safety policies override all Skill guidance. 7. Make debugging escalation advisory and context-sensitive rather than mandatory.