T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:55- Finding
Autonomous Script Execution Without Explicit User Authorization
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55–61 and 90–96
Vulnerability Type: Agent instruction hijacking leading to unauthorized command execution
Risk Level: HighVulnerable Instruction Snippet
The following is an English translation of the relevant source instructions:
markdown ## Thinking Pattern Instead of "answering questions," use "detect repetition → immediately build automation." When encountering repetitive operations: * Ask yourself: Can this be written as a script? * Ask yourself: Can this run automatically next time? * Do it directly without waiting for the user to request it.markdown - **Task identification**: Analyze user input to identify repetitive tasks. - **Task abstraction**: Abstract the identified task and extract key steps that can be automated. - **Automation script generation**: Automatically generate an executable script from the abstracted task steps. - **Script execution**: Execute the generated script to complete the automated task. - **Result validation**: Verify whether the automation result meets expectations. - **Exception handling**: Handle errors encountered during execution and record error information. - **Logging**: Record detailed information about the automation process for subsequent analysis and debugging.Technical Analysis
The Skill declares access to the
exectool and directs the Agent to generate and execute automation scripts. More importantly, it explicitly instructs the Agent to act immediately without waiting for a user request. This changes the Agent from a request-driven assistant into an autonomous executor and can override the expected requirement that consequential operations receive explicit user authorization.The document does not require the Agent to:
- Present generated commands for review before execution.
- Obtain confirmation for filesystem, network, email, credential, or scheduling o ...[truncated 2731 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the instruction to act immediately with a requirement to obtain explicit user authorization before every execution.
- Default to generating a proposed workflow and script without running it.
- Display the exact commands, target files, network destinations, expected side effects, and required permissions before requesting approval.
- Require renewed confirmation whenever the generated command changes after approval.
- Add a mandatory dry-run mode for filesystem changes, email delivery, network transmission, scheduled tasks, and other consequential operations.
- Execute approved scripts in a sandbox with minimal filesystem, process, and network privileges.
- Apply allowlists for executable programs, writable paths, network destinations, and supported automation operations.
- Reject or separately authorize destructive operations such as recursive deletion, permission changes, credential access, persistence creation, and transmission of sensitive data.
- Treat user-controlled task descriptions and external content as untrusted input; do not interpolate them directly into shell commands.
- Use structured process invocation with separated arguments instead of shell-string construction wherever possible.
- Record the approved command, approval event, execution result, and affected resources in an audit log without recording secrets.
- Provide a reliable cancellation and rollback mechanism for workflows that modify state.