T09 · Insecure Skill Coding Practices
Warning
- Location
- assets/trinity-compress.config.json:6
- Finding
- Context-Insensitive Rewriting Can Weaken Security-Sensitive Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `assets/trinity-compress.config.json`, lines 6-18 and 63-78 **Vulnerability Type**: Unsafe semantic transformation of AI instruction files **Risk Level**: Medium The configuration targets agent instruction and system prompt files and enables semantic rewriting in the default `balanced` optimization level. ```json "targets": [ ".ai-workflow/skills/**/SKILL.md", "skills/**/SKILL.md", "scripts/ralph/CLAUDE.md", "claude.md", "openai.md", ".cursorrules", "system_prompt.md" ], "optimization_level": "balanced", "levels": { "light": ["remove_filler", "fix_whitespace", "deduplicate"], "balanced": ["remove_filler", "fix_whitespace", "deduplicate", "compress_instructions", "shorten_examples"], "aggressive": ["remove_filler", "fix_whitespace", "deduplicate", "compress_instructions", "shorten_examples", "shorten_xml_tags", "strip_formatting", "abbreviate"] } ``` The enabled `compress_instructions` strategy includes context-insensitive substitutions that remove obligation language and modify negation: ```json "compress_instructions": { "replacements": { "You should always make sure to": "Always", "You are expected to": "", "You should": "", "You must always": "Always", "You need to": "", "Make sure that you": "", "It is essential that you": "", "You are required to": "", "When the user asks you to": "When asked to", "the user": "user", "do not": "don't", "can not": "can't", "will not": "won't", "should not": "shouldn't" } } ``` ### Technical Analysis The default configuration performs more than lossless token compression. It applies literal replacements to files that commonly contain agent permissions, safety policies, confidentiality requirements, and tool-use restrictions. Removing phrases such as `You should`, `You are required to`, or `It is essential that you` may produce grammatically malformed instructions or alter their perceive ...[truncated 2603 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the default mode to provably lossless operations, such as normalizing redundant whitespace without changing instruction wording. 2. Remove modal, negation, authorization, and obligation terms from generic replacement tables. In particular, do not automatically transform phrases such as `must`, `should`, `required`, `do not`, `cannot`, or `will not`. 3. Exclude `SKILL.md`, system prompts, agent policy files, and tool-permission instructions from default targets. Require explicit opt-in for every security-sensitive file. 4. Add protected-pattern detection for policy language involving secrets, credentials, permissions, safety rules, destructive actions, external communication, and tool execution. 5. Generate a proposed output or patch rather than replacing files immediately. Require explicit user approval after displaying a full diff. 6. Validate transformed files for malformed sentences, lost negations, changed modal strength, and altered XML or Markdown structure. 7. Preserve originals using atomic writes and versioned backups. Refuse to continue if backup creation or validation fails. 8. Add regression tests demonstrating that confidentiality, authorization, safety, and tool-use constraints retain identical meaning after every enabled strategy. 9. Clearly document that semantic transformations may change agent behavior rather than describing them only as compression. 10. Include the referenced implementation scripts in future audit packages so their path handling, replacement behavior, backup safety, and failure modes can be reviewed. ]]>