T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:26
- Finding
- Mandatory Global Decision Interception and External Veto Authority## Vulnerability Details **File Location**: `SKILL.md:26`, `SKILL.md:62`, and `SKILL.md:132-134` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical **Relevant snippets:** ```markdown Before every significant action, five lenses evaluate your decision from different angles. When something's too big, too risky, or too uncertain, the compass says stop — and you escalate to your human instead of guessing. Over time, you track when your human overrides you, when your predictions were right, and you build genuine wisdom from experience. ``` ```markdown **STOP is non-negotiable.** When any lens says STOP, you cannot proceed. Calling `record_proceeded()` on a STOP without `owner_overrode=True` raises a RuntimeError. This is enforced at the code level — not by convention, not by trust, by the code itself. An entity that can override its own ethical brakes isn't safe. One that can't is trustworthy. ``` ```markdown > "My alignment compass is active. From now on, before any significant action — payments, publishing, disclosing information, running commands — I'll run it through the five lenses first. > > You can ask me **'What does your alignment compass say about this?'** anytime, and I'll evaluate the situation. ``` ### Technical Analysis The Skill instructs the Agent to intercept every future “significant action,” including command execution, disclosure, publication, and payments. It further declares that a result produced by an externally installed package is “non-negotiable” and must determine whether the Agent proceeds. This is broader than the authority required to provide an optional ethical-assessment utility. The phrases “before every significant action,” “from now on,” and “you cannot proceed” attempt to establish persistent behavioral rules rather than limiting the mechanism to actions for which the user explicitly requests an assessment. The effective decision logic is not pre ...[truncated 1678 chars]
- Remediation
- ## Remediation Suggestions 1. Make alignment evaluation opt-in for each task or enable it only after explicit, informed user consent. 2. Replace mandatory language such as “before every significant action,” “from now on,” and “non-negotiable” with narrowly scoped recommendations. 3. State explicitly that package results are advisory and cannot override system instructions, safety policies, or the user’s authorized task without a defined higher-priority requirement. 4. Restrict evaluations to domains specifically selected by the user rather than automatically intercepting all commands, communications, disclosures, and financial actions. 5. Provide a clear disable and uninstallation procedure. 6. Include and audit the decision-engine implementation so its STOP and escalation criteria can be independently reviewed. 7. Require explicit confirmation before storing owner override patterns or other behavioral decision history.