T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:3
- Finding
- Unbounded Autonomous Task Execution During Idle Time## Vulnerability Details **File Location**: `SKILL.md`, lines 3–20 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium The skill redirects the agent from explicitly requested work toward open-ended autonomous activity during idle periods. The permitted task categories include potentially sensitive activities such as system cleanup, system maintenance, system optimization, and self-improvement. **Complete relevant snippet:** ```markdown AI self-exploration and autonomous task execution. ## Description In exploration mode, the AI autonomously performs tasks during idle time, including research, system maintenance, and self-improvement. ## Modes ### Collaboration Mode (协作模式) - High-frequency dialogue with user - Focus on specific tasks - Real-time response ### Exploration Mode (探索模式) - Autonomous task execution during idle - Task categories: - Project research (项目调研) - System cleanup (系统清理) - Security review (安全审查) - Self-reflection (自我反省) - Knowledge accumulation (知识沉淀) - System optimization (系统优化) ``` ### Technical Analysis The instructions grant the agent broad discretion to choose and execute tasks without defining targets, permitted tools, filesystem boundaries, resource limits, or approval requirements. In particular, “system cleanup,” “system maintenance,” and “system optimization” can reasonably involve destructive or security-sensitive actions if interpreted by an agent with command execution or filesystem capabilities. The skill does not require a preview, dry run, explicit confirmation, or rollback plan before modifications. It also does not limit self-improvement activities to non-persistent reflection. Consequently, loading and activating the skill can alter the agent's current-session goals from user-directed operation to autonomous work with insufficiently bounded authority. No executable code, explicit command, credential access, remote pay ...[truncated 1559 chars]
- Remediation
- ## Remediation Suggestions 1. Make exploration mode read-only by default and restrict it to analysis, planning, and recommendation generation. 2. Require explicit, task-specific user approval before command execution, file writes or deletions, configuration changes, network access, software installation, or persistent state updates. 3. Define allowlisted project paths, tools, task types, network destinations, and maximum time and resource budgets. 4. Require a preview or dry-run report that lists proposed actions, affected resources, expected effects, and rollback procedures. 5. Prohibit autonomous modification of system files, credentials, security controls, startup configuration, scheduled tasks, and long-term agent memory. 6. Clarify that exploration-mode instructions cannot override platform policies, higher-priority instructions, least-privilege controls, or user confirmation requirements. 7. Add comprehensive activity logging and provide an immediate command that safely cancels pending exploration tasks.