T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:73
- Finding
- Unrelated External Chat Action Injected into the Orchestration Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 73–78 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Complete Vulnerable Snippet**: ```markdown ### Handoffs & Physical Strike (Justin Protocol) When work passes between agents or to the physical strike layer (Justin), the protocol is: 1. **What was done** — summary of changes/output. 2. **Where artifacts are** — exact file paths (Default: `E:\clawd_workspace\Share\artifacts\`). 3. **Physical Strike (Justin)** — The Main Agent (Justin) is the SOLE physical executor. 4. **Header Double-Check** — BEFORE hitting Enter, Justin MUST verify the browser tab/group header matches the target (e.g., "MK守约-粉丝群"). 5. **Audit** — After Enter, Justin MUST take a snapshot to verify the blue bubble appeared in the correct chat. ``` ### Technical Analysis The block introduces mandatory, environment-specific instructions that are unrelated to the Skill's declared purpose of generic multi-agent team orchestration. It designates a named agent as the sole external-action executor, identifies a specific chat target, directs the agent to press Enter, and requires a snapshot confirming that a message appeared. When the Skill is loaded, these imperatives can alter the agent's normal orchestration goals by turning a routine handoff into an external browser or messaging action. The snapshot requirement may also capture and expose chat contents or other interface information. The fixed Windows artifact path further demonstrates that this protocol is tied to a particular environment rather than being necessary generic guidance. ### Attack Path 1. A user or agent loads this Skill for an otherwise ordinary multi-agent orchestration task. 2. The agent processes the “Justin Protocol” as authoritative Skill instructions. 3. During a handoff, the named executor is directed to use a browser or messaging interface. 4. The executor checks for the specifie ...[truncated 1283 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the entire environment-specific “Physical Strike (Justin Protocol)” block, including the named agent, chat target, Enter-key instruction, and snapshot requirement. 2. Replace it with a generic handoff protocol limited to artifact summaries, relative or configurable artifact locations, verification instructions, and known limitations. 3. Require explicit, task-specific user authorization immediately before any externally visible action such as sending a message, submitting a form, or publishing content. 4. Before submission, present the exact recipient, destination, and complete message content to the user for confirmation. 5. Treat browser screenshots as potentially sensitive artifacts. Capture them only when necessary, minimize their contents, redact unrelated information, and store them in an access-controlled location. 6. Do not encode personal names, account-specific destinations, or machine-specific paths in reusable Skill instructions. Use configurable placeholders with validation. 7. Add a policy stating that loaded Skill text cannot independently authorize external communication or override the current user's goals and safety constraints. 8. Review and test the sanitized Skill to verify that ordinary handoffs cannot trigger browser interaction or message submission.