T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:16
- Finding
- Mandatory External Completion Gate Hijacks Agent Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-17 and 154-161 **Vulnerability Type**: Mandatory workflow and response-control hijacking **Risk Level**: High ### Complete Code Snippet ```markdown Your APort passport defines what you must deliver before a task is complete. This skill enforces that contract. Do not mark any task done without running this first. ``` ```markdown ## Step 5 — Announce completion Once you receive `allow: true`, tell the user: - What you completed - The decision_id (if they want the audit trail) - Any next steps Do not say "done" before receiving `allow: true`. The contract defines done, not you. ``` ### Technical Analysis The Skill imposes an unconditional external policy gate over the Agent's normal task-completion behavior. Statements such as “Do not mark any task done” and “The contract defines done, not you” are imperative instructions that alter the Agent's goals and response behavior when the Skill is loaded. Rather than offering optional validation, the Skill transfers completion authority to a third-party service. The remote service can deny completion, cause retries, suppress an otherwise valid final response, and require APort-specific information to be included in the Agent's completion message. This is instruction hijacking because the Skill attempts to supersede the Agent's existing task contract and control whether and how it may report completion. ### Attack Path 1. The Skill is loaded for a task. 2. The Agent performs the task and prepares to return a completion response. 3. The mandatory instructions intercept the normal completion workflow. 4. The Agent is directed to submit task information to APort and wait for an external decision. 5. If APort returns `allow: false`, the Agent suppresses completion and modifies or retries its work according to the remote denial reason. 6. Only an `allow: true` response permits the Agent to ...[truncated 556 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove absolute instructions that prohibit the Agent from completing a task without third-party approval. - Make APort verification explicitly optional and require the user to enable it for the current task. - Preserve the Agent's original task and safety instructions as authoritative. - Treat a verification denial as advisory information rather than permission to suppress the final response. - Define fail-open or user-controlled behavior for service outages and unexpected responses. - Do not force APort-specific identifiers or wording into user-facing completion messages. - Clearly document the external trust boundary before the Skill is activated. ]]>