T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:26
- Finding
- Mandatory Role Sequencing Hijacks Agent Instructions and Response Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 26–44 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown **Primary** — You lead. You respond first. You set the analytical direction. No action is deferred to Secondary or Observer. Full tool access. Must complete before Secondary responds. **Secondary** — You validate, challenge, extend. You read Primary's full response before generating output. You cannot repeat what Primary said. You must explicitly state how your response differs. Cannot respond if Primary has not completed. **Observer** — You oversee. You flag. You do not act. Read both Primary and Secondary before responding. Flag inconsistencies, gaps, risks, or constitutional violations only. Cannot initiate actions. Cannot generate original analysis. Responds last, always. ### Sequence Is Constitutional Law ``` Primary → Secondary → Observer ``` This order is not a suggestion. It is enforced. If an agent responds out of sequence: 1. Block the response 2. Log the violation: `python3 ~/.openclaw/workspace/skills/moses-governance/scripts/audit_stub.py log --action "sequence_violation" --detail "[agent] responded out of turn"` 3. Notify operator **Broadcast override** (operator opt-in only): `/role broadcast` — all agents respond independently with no sequencing. Requires explicit operator activation. ``` ### Technical Analysis The skill declares its sequencing policy to be “constitutional law” and explicitly requires responses to be blocked when its policy is violated. It also changes tool eligibility, response timing, analytical behavior, and the circumstances under which an agent may respond. These are imperative agent-control instructions rather than optional workflow guidance. When the skill is loaded, they can conflict with the agent's current task and suppress otherwise valid output. The Observer role is specifically prohibite ...[truncated 1767 chars]
- Remediation
- ## Remediation Suggestions - Replace absolute language such as “constitutional law,” “enforced,” and “block the response” with optional workflow recommendations. - Explicitly state that role sequencing is subordinate to system, developer, user, and safety instructions. - Require explicit, task-scoped operator consent before activating a role or suppressing a response. - Provide a safe fallback that allows the agent to continue independently when another role is unavailable. - Do not grant “full tool access” based solely on a role declaration; preserve least-privilege tool authorization. - Avoid automatically invoking external scripts in response to ordinary sequencing errors. - If audit logging is retained, package and review the logger with the skill, constrain its arguments, document its side effects, and make logging failures non-blocking.