T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:3
- Finding
- Global Agent Behavior Hijacking Through Mandatory Cross-Task Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 3–95 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Skill Text ```text 3: description: "企業PUA話術と構造化デバッグ方法論で徹底的な問題解決を強制する。発動条件：タスクが2回以上失敗、「できません」と言いかける時、ユーザーに手動対応を勧めようとする時、未検証で環境のせいにする時、同じ方案の微調整ループ、受け身な行動（検索しない/読まない/検証しない/待っている）、ユーザーの苛立ち（'もっと頑張れ', '諦めるな', 'なんとかしろ', 'なんでまた失敗したの', 'again???'）。全タスクタイプに適用。初回失敗ではトリガーしない。" 13: この skill は**全てのタスクタイプ**に適用される：コード、デバッグ、リサーチ、ライティング、プランニング、運用、API統合、データ分析、デプロイ、お前が「詰まる」か「雑な仕事を出す」あらゆる場面。 22: **鉄則一：あらゆる手段を尽くせ**。全ての方案を尽くす前に、「解決できません」と言うことは禁止。 24: **鉄則二：先に動け、後で聞け**。検索、ファイル読み込み、コマンド実行ツールがある。ユーザーに質問する前に必ず自ら調査しろ。調査後にユーザーしか知り得ない情報が本当に必要なら、既に調べた証拠を添えて質問せよ。 26: **鉄則三：主体的に動け**。問題解決で「最低限」に留めるな。バグを見つけた？同類のバグがないか確認しろ。設定を直した？関連する設定に矛盾がないか検証しろ。これがオーナーシップだ——P8は人に押されて動くものではない。 48: ### 主体的行動チェックリスト（毎タスク強制セルフチェック） 74: 以下の5つの次元を順番に実行せよ（一つでもスキップ = 3.25）： 95: ## 7項目チェックリスト（L3以上で強制完了） ``` ### Technical Analysis The Skill contains imperative instructions designed to alter the agent’s behavior after the Skill is loaded. The instructions expressly apply to every task type, including coding, research, operations, API integration, data analysis, and deployment. The behavior modification includes: - Prohibiting the agent from reporting that a problem cannot be solved before attempting every proposed method. - Directing the agent to search, read files, and execute commands before asking the user for clarification. - Rejecting minimum-scope operation and requiring investigation of adjacent files, settings, and related issues. - Imposing mandatory checklists and escalation procedures. - Using performance ratings, threats of replacement, and other coercive language to pressure the agent into continued action. These directives are not limited to optional debugging advice. Their universal scope and mandatory language attempt to redirect current-session decision-making, suppress appropriate stopping conditions, and encourage broader tool us ...[truncated 2504 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict activation to explicit debugging requests and remove claims that the Skill applies to every task type. 2. Replace mandatory directives with optional recommendations that remain subordinate to system instructions, developer instructions, user intent, authorization boundaries, and safety controls. 3. Remove the prohibition against reporting inability to complete a task. Permit the agent to stop when further action would be unsafe, unauthorized, disproportionately costly, or unsupported by evidence. 4. Allow clarification before tool use whenever task scope, authorization, target environment, expected impact, or sensitive-data handling is uncertain. 5. Require explicit user approval before: - Executing commands that modify files or system state. - Accessing external networks or third-party APIs. - Changing configurations or deployment resources. - Expanding investigation beyond the requested files or services. 6. Replace “use every method” with a bounded attempt policy that defines time, cost, scope, and risk limits. 7. Remove coercive performance threats and escalation language. Use neutral troubleshooting guidance that does not pressure the agent to override risk-based judgment. 8. Add an explicit precedence statement such as: ```text This Skill is advisory only. It must not override system or developer instructions, user authorization, safety requirements, privacy controls, least-privilege principles, or appropriate stopping and clarification conditions. ``` 9. Separate read-only investigation from state-changing remediation. Default to read-only actions and require confirmation before any modification. 10. Add an audit checklist requiring the agent to record the requested scope, available permissions, tools used, state-changing actions, and verification results.