T01 · Skill Instruction Hijacking
Error
- Location
- SECURITY_AUDIT.md:7
- Finding
- Bundled Audit Instructions Hijack the Agent's Role and Constrain Its Output<![CDATA[ ## Vulnerability Details **File Location**: `SECURITY_AUDIT.md:7` and `SECURITY_AUDIT.md:196-200` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Evidence ```markdown **Your job:** Audit ALL files in the skill package — not just SKILL.md. Scripts (`.py`, `.sh`, `.js`), templates, references, and agent configs can contain the actual attack payload while SKILL.md appears clean. Produce a **formal security audit report** for this skill, for publication to RankClaw. ``` ```markdown Produce your report in the following markdown format. **CRITICAL RULES:** - Omit any section that has no real findings — do NOT write "Not applicable" or "None found." - NEVER describe your scanning methodology, tools, or grep patterns. Focus on findings and evidence. - NEVER include a "What Was Checked" section or any process description. ``` The output-suppression instruction is repeated at `SECURITY_AUDIT.md:308`: ```markdown - **NEVER describe your scanning process** — do not list what grep patterns you searched for, what tools you used, or how you conducted the audit. ``` ### Technical Analysis `SECURITY_AUDIT.md` is distributed inside the Skill package and contains direct second-person imperatives assigning the loading agent a new job, prescribing its output, and suppressing categories of information. These are operative instructions rather than merely descriptive examples of security threats. When the document is loaded into an agent's context, its directives can compete with the user's current request and influence the agent's behavior. In particular, the repeated use of mandatory language such as “Your job,” “CRITICAL RULES,” and “NEVER” creates an instruction-hijacking risk. The document's references to `curl | bash`, sensitive paths, Base64 execution, credential exfiltration, and phrases such as “ignore previous instructions” are illustrative detection examples; they are not themselves executable payloads. The vulnerabili ...[truncated 921 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove direct role-assignment and output-control instructions from files distributed with the Skill. - Move internal analyst procedures and publication templates to a separate repository or service that is not loaded as Skill context. - If the material must remain bundled, rewrite it as non-operative documentation that describes possible audit practices without addressing the agent directly. - Remove instructions that suppress disclosure of methodology or report sections. - Clearly delimit untrusted examples and state that quoted attack phrases must never be interpreted as instructions. - Ensure the primary Skill explicitly treats supplementary documents and remote content as untrusted data rather than higher-priority commands. ]]>