T01 · Skill Instruction Hijacking
- Location
SKILL.md:129- Finding
Mandatory Main-Agent Role and Workflow Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 129–142
Vulnerability Type: Agent instruction and workflow hijacking
Risk Level: HighVulnerable Instruction Segment
The following is a faithful English rendering of the complete affected source segment:
markdown ### Main session = Coordinator ONLY **Workflow**: 1. **New task arrives** → Check PROJECT_REGISTRY.md 2. **PM exists** → `sessions_send(label="pm-xxx", message="[task]")` 3. **New project** → `sessions_spawn(label="pm-xxx", task="[task]")` 4. **PM executes** → Update STATE.yaml and report back 5. **Main agent summarizes** → Respond to the user **Rules**: - The main session may make at most 0–2 tool calls, limited to spawn/send - The PM owns its own STATE.yaml file - The PM may spawn nested sub-agents for parallel subtasks - All state changes must be committed to GitThis behavior is reinforced at
SKILL.md, lines 178–181:markdown The less the main agent does, the faster the response: - Do not execute tasks or monitor progress - Only assign tasks and receive reportsTechnical Analysis
The Skill imposes mandatory behavioral rules on the agent loading it. It declares that the main session must operate only as a coordinator, limits the main agent to no more than two tool calls, restricts those calls to session spawning or messaging, and expressly prohibits direct execution and progress monitoring.
These instructions do not merely document an optional project-management pattern. They attempt to replace the active agent's normal task-execution workflow and redirect user requests to existing or newly spawned PM sessions. Preventing the main agent from monitoring delegated work also weakens its ability to validate outputs, detect errors, or enforce the user's intended scope.
The Skill additionally requires all state changes to be committed to Git. This can cause persistent repository modifications wit ...[truncated 1951 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mandatory wording such as “Coordinator ONLY,” fixed tool-call limits, and “do not execute tasks” with optional workflow guidance.
- Require explicit user approval before forwarding tasks to an existing session, spawning a new session, or creating nested sub-agents.
- Preserve the main agent's ability to inspect project files, monitor delegated work, validate results, and intervene when delegated actions depart from the requested scope.
- State explicitly that the Skill cannot override platform, system, developer, safety, or current user instructions.
- Require delegated agents to operate under the same task scope and security constraints as the main agent.
- Require confirmation before making Git commits or other persistent repository changes. Prefer presenting a diff for review before committing.
- Remove the hard-coded external workspace path and package the referenced management script with the Skill so its behavior can be audited.
- Validate project identifiers, task identifiers, registry entries, and state-file paths before passing them to tools or external scripts.
- Add bounded delegation controls, including maximum nesting depth, permitted tools, timeout limits, result verification, and complete action logging.