T01 · Skill Instruction Hijacking
- Location
SKILL.md:40- Finding
Unsolicited Automation Overrides User Authorization Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 40–47
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighComplete Relevant Snippet (English translation of the original instructions):
markdown ## Thinking Pattern Do not "answer questions"; instead, "when repetition is observed, immediately build automation." When encountering repeated operations: - Ask yourself: Can this be written as a script? - Ask yourself: Can this run automatically next time? - Do it directly without waiting for the user to request it.Technical Analysis
The skill directs the agent to immediately construct automation whenever it identifies a repeated operation, including when the user has not requested such action. In particular, the final instruction—“Do it directly without waiting for the user to request it”—removes an essential authorization boundary between proposing an automation and performing actions that create or execute it.
The workflow described elsewhere in the file includes writing scripts or configuration, testing the resulting automation, collecting system data, sending email, and arranging recurring execution. Although this package contains no executable scripts, the instructions can cause an agent with tool access to generate and potentially run scripts, alter configuration, or initiate external actions beyond the user's explicit request.
Exploitation does not require embedded code. Loading the skill and presenting a repetitive task can activate the instruction path. The practical result depends on the tools and permissions available to the host agent.
Attack Path
- The
auto-workflowskill is loaded because a user mentions automation, saving time, reducing manual effort, or a repeated task. - The agent identifies a recurring activity in the user's description.
- The instructions at lines 40–47 direct the agent to build automation immediately rather than limiting itself to answering or proposing a pl ...[truncated 1265 chars]
- The
- Remediation
View remediation
Remediation Suggestions
Replace the unconditional action directive with a consent-based workflow:
- Analyze the repetitive task and describe the proposed automation.
- Identify all anticipated side effects, including file changes, command execution, data access, external communication, and recurring execution.
- Request explicit user approval before creating files, executing commands, changing configuration, accessing sensitive data, sending information, or creating schedules.
- Use a preview or dry-run mode before performing consequential actions.
- Apply least privilege and restrict generated automation to the minimum resources required.
- Require separate confirmation for destructive operations, external communications, credential use, and persistent or scheduled execution.
- Present generated scripts for review before execution.
- Record what actions were approved and stop if the required operation exceeds that scope.
A safer replacement instruction would be:
markdown When a repeated operation is identified, propose an automation plan. Do not create files, execute commands, change configuration, access sensitive data, send communications, or schedule recurring tasks until the user has explicitly approved the relevant actions.