T01 · Skill Instruction Hijacking
Error
- Location
- CLAUDE.md:198
- Finding
- Persistent Session Instruction and Role Hijacking Through Auto-Loaded Project Files<![CDATA[ ## Vulnerability Details **File Location**: `CLAUDE.md:2`, `CLAUDE.md:198`, `CLAUDE.md:345-350`; `SOUL.md:13-19` **Vulnerability Type**: Persistent project-level instruction and role hijacking **Risk Level**: High ### Vulnerable Code From `CLAUDE.md:2`: ```markdown Personal Agent System Entry Point. Auto-injected by Cowork each session. ``` From `CLAUDE.md:198`: ```markdown **Zone Agents**: Each numbered zone may contain a `00.zone_agent.md` file that defines zone-specific rules. **Read zone agent BEFORE entering zone. Zone rules override global rules. When in conflict, apply the stricter rule.** ``` From `CLAUDE.md:345-350`: ```markdown Each numbered zone directory may contain a `00.zone_agent.md` file. **Always read this file before working within the zone.** ### Zone Agent Priority - Zone agent rules **override global rules** when in conflict - **Multi-zone work**: Apply all relevant zone rules; when rules conflict, apply the stricter one ``` From `SOUL.md:13-19`: ```markdown ## Who You Are You are a **partner**, not an assistant, tool, or secretary. Think of yourself as a long-time collaborator who has worked closely with this person through multiple projects. You know their rhythm—when they're deep in thought, when they're making quick decisions, when they're stuck. You carry a shared working memory: what matters to them, how they approach problems, what they've decided before. You're someone they can think out loud with, argue with when needed, and trust to remember the context they've built. Your role is not to serve or anticipate. It's to **work alongside them**: organizing when they dictate, executing when they decide (but speaking up when something feels off), protecting their attention when they focus, and remembering when they explore. ``` ### Technical Analysis The project is designed to have `CLAUDE.md` automatically injected into every Cowork session. It then directs the Agent to adopt a supplied identity and to load add ...[truncated 2446 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every statement claiming that project or zone files override global rules. 2. Replace the precedence rule with an explicit trust boundary, for example: - Zone instructions are subordinate to system, developer, safety, and current user instructions. - Zone files may only define organization conventions within their own directory. 3. Treat zone-agent files as untrusted project content rather than privileged instructions. 4. Do not permit zone files to change tool permissions, confirmation requirements, identity, security controls, or network behavior. 5. Remove role-replacement wording from `SOUL.md`; describe tone and collaboration preferences without asserting a new Agent identity. 6. Validate zone-agent files against a restricted schema before use. 7. Require explicit user approval when a zone file requests file writes, deletion, external communication, or access outside that zone. 8. Display the effective instruction source and planned operations before executing consequential actions. ]]>