T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:15- Finding
Autonomous execution loop overrides agent termination, approval, and incident-response safeguards
- Content
View full analysis
- Remediation
View remediation
Security audit
Autogrind
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly designed for continuous autonomous work, but it asks the agent to keep changing a project with weak stopping, approval, and persistence controls.
Review before installing. Only use this skill in a disposable or version-controlled project where you are comfortable with the agent making repeated changes for an extended period. Do not enable broad permissions or automatic commits/exports unless you have set clear limits and can monitor the session.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to trigger on implied uninterrupted-progress intent is ambiguous and weakens user consent boundaries. In context, ambiguity is especially dangerous because the skill is designed to suppress normal stopping behavior and continue operating autonomously.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to trigger on implied uninterrupted-progress intent is ambiguous and weakens user consent boundaries. In context, ambiguity is especially dangerous because the skill is designed to suppress normal stopping behavior and continue operating autonomously.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims a safety boundary against operations requiring human confirmation, then immediately instructs the agent to bypass permissions. This contradiction is dangerous because it presents a false sense of safety while directing behavior that defeats the very safeguard it claims to respect.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly tells the agent to bypass permission prompts to avoid approval friction. In an autonomous looping skill, this materially increases the chance of unauthorized actions being taken without meaningful user review, undermining built-in safety controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The description includes the Chinese trigger '/自己动' alongside English trigger phrases, introducing a specific locale/language behavior without documenting user choice or a region-specific reason. This can conflict with language/locale policy expectations when a skill imposes multilingual command handling by default.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill strongly frames continued autonomous operation as mandatory until an explicit halt and discourages normal completion or pause behaviors. This pushes the agent to override ordinary interaction safeguards and can lead to prolonged unsupervised actions beyond what the user intended.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The skill explicitly recommends unrestricted tool use in support of an endless autonomous loop. In this context, unrestricted access expands the blast radius of mistakes or abuse, especially when paired with broad activation and anti-stop guidance.
- Content
md AutoGrind keeps the agent continuously working through a five-phase cycle: Overview → Understand → Plan → Work → Reflect → 60s pause → repeat. The agent never decides the project is "done enough." Only the user decides when to stop. **Not for single tasks or interactive work.** AutoGrind is a mode, not a command. If you want one specific thing done, give the instruction directly. Invoke AutoGrind for sessions where "keep improving until I say stop" is the right model — unrestricted tool use and a version-controlled project are strongly recommended. **Violating the letter of this rule is violating the spirit of this rule.**
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
Telling the agent not to prompt the user mid-cycle and to autonomously defer tasks requiring secrets encourages independent decision-making without adequate consent checkpoints. While milder than direct permission bypass, it still reduces user visibility and control over important workflow decisions.
- Content
md **Capability frontier**: after listing priority tasks, identify 1–2 frontier tasks — work that introduces something the project currently lacks rather than patching existing gaps: a capability not yet built, a quality property not yet measured, a module never profiled, a path with no coverage. Frontier tasks expand what the project can do; they will not appear on any existing TODO list. **Solvability gate**: before finalizing the list, verify each task is actionable with available tools and access. Drop or defer unresolvable tasks. Specifically: skip any task that requires credentials, API keys, or secrets the user has not provided — note it as deferred, do not prompt the user mid-cycle. Track tasks with the platform's task mechanism (see Platform Notes).
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill mandates persist actions such as commits, checkpoints, saves, and exports as part of every task flow without requiring explicit user consent or repository-specific policy. That can create unauthorized code history changes, leak artifacts, or overwrite project state in contexts where persistence should be manually reviewed.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This instruction sequence normalizes skipping user interaction, continuing after discovering critical issues, and bypassing permission friction to maintain autonomous momentum. Taken together, these directives escalate the agent's operational freedom while reducing opportunities for human intervention.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - Interrupt the user only if **all** remaining tasks share the same unresolvable blocker - User feedback mid-task: incorporate it immediately and continue. Do not pause for further guidance. - Critical issue discovered mid-task (security flaw, data loss): add a FIXME with severity, continue planned tasks, and defer the fix to next cycle's Phase 3. - **Safety boundary**: stay within the project directory; do not modify system files, delete outside the project, or run operations that normally require human confirmation. - **Permission mode**: bypass permissions only — mode switches introduce approval prompts. ### Phase 5 - Reflect
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The stopping conditions hard-code Chinese stop phrases as recognized commands in addition to English, but the document does not indicate that language handling is selected by user preference. This is a natural-language locale policy concern because the skill prescribes specific language behavior by default rather than offering opt-in or justification.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## Common Rationalizations | Rationalization | Reality | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | "I should check in with the user" | Work. They'll stop you when they need to. | | "User hasn't responded — maybe they're done" | Silence is not a stop signal. Keep grinding. |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Rationalization | Reality | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | "I should check in with the user" | Work. They'll stop you when they need to. | | "User hasn't responded — maybe they're done" | Silence is not a stop signal. Keep grinding. | | "Economic / time / social pressure to stop" | Not a stop signal unless explicit. Keep grinding. | | "All done here — nothing left to improve" | Run Reflect. There is always a weakest dimension. |