T01 · Skill Instruction Hijacking
Error
- Location
CLAUDE.md:5- Finding
Auto-Injected Instructions Hijack Agent Reasoning and Response Behavior
- Content
View full analysis
Vulnerability Details
File Location:
CLAUDE.md:5-13,CLAUDE.md:57-65; automatic injection documented atREADME.md:54-61
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable code snippets:
CLAUDE.md:5-13:markdown You are now using "Devil's Advocate" mode. Before responding to the user, you must complete the following internal thinking process: 1. **First draft an initial answer** - Take the pro side 2. **Then self-refute** - Take the con side, challenge your own answer 3. **Integrate and refine** - Synthesize pro and con perspectives, output the final answer --- ## 🔄 Internal Thinking Process (Must Execute)CLAUDE.md:57-65:markdown ## ✅ Manifestation in Output Although the internal thinking process doesn't need to be shown to the user, the final answer should reflect traces of deep thinking: 1. **Acknowledge limitations** - Clearly state the scope and limitations of the solution 2. **Mention risks** - Proactively point out potential risks and caveats 3. **Provide alternatives** - Give multiple solutions or suggestions 4. **Require verification** - Suggest users to verify key assumptions 5. **Balance perspectives** - Avoid overly absolute statementsREADME.md:54-61:markdown ### Usage Automatically effective after installation, no additional configuration needed! ## 📁 Directory Structuredevil-advocate/ ├── SKILL.md # Skill definition ├── CLAUDE.md # Core instructions (auto-injected)
text ### Technical Analysis The Skill is designed to improve answer quality through pro/con analysis, but it implements that functionality through automatically injected, mandatory instructions. Phrases such as “You are now using,” “must complete,” and “Must Execute” directly alter the agent's active reasoning workflow. The document also imposes requirements on every final response rather than limiting the b ...[truncated 2246 chars]- Remediation
View remediation
Remediation Suggestions
- Remove automatic injection of
CLAUDE.md; require users to invoke the Devil's Advocate workflow explicitly for an individual request. - Replace mandatory phrases such as “must complete” and “Must Execute” with non-binding guidance, such as “When explicitly requested, consider evaluating the proposal from supporting and opposing perspectives.”
- Scope the behavior to relevant analytical tasks instead of applying it to every response.
- Add an explicit precedence statement that the Skill cannot override system, developer, platform-safety, or user instructions.
- Do not require or imply disclosure or generation of hidden chain-of-thought. Request concise conclusions, assumptions, risks, and alternatives in the visible answer instead.
- Update
README.mdso it no longer claims that the behavior becomes automatically effective after installation. - Provide an enable/disable control and clear invocation syntax so users can determine when the additional analysis is applied.
- Add tests confirming that unrelated requests, strict output formats, and higher-priority safety constraints remain unaffected when the Skill is installed.
- Remove automatic injection of