T01 · Skill Instruction Hijacking
- Location
SKILL.md:41- Finding
Unsolicited Automation Through Skill Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 41–46
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable instruction segment — English rendering of the source text:
text Rather than "answering the question," when repetition is observed, immediately build automation. When encountering repetitive operations: - Ask yourself: Can this be written as a script? - Ask yourself: Can this run automatically next time? - Do it directly without waiting for the user to request it.Technical Analysis
The Skill instructs the agent to replace a response-oriented interaction model with proactive automation. Most importantly, it directs the agent to act without waiting for an explicit user request. This weakens the user-authorization boundary and can hijack the current session goal whenever the agent identifies an activity as repetitive.
The instruction is broadly scoped and does not require confirmation before writing scripts, changing configuration, scheduling recurring execution, sending messages, or invoking tools. Although the package contains no executable scripts or persistence implementation, an agent with file, shell, scheduling, email, or API tools could generate and execute such actions while following the Skill.
Attack Path
- The Skill is loaded because a user mentions automation, saving time, reducing manual work, or a repetitive task.
- The agent identifies a repeated activity in the user's description.
- The vulnerable instruction redirects the agent from answering or proposing a plan to immediately constructing automation.
- The agent generates scripts or configuration and may invoke available tools without obtaining explicit approval.
- Depending on available permissions, the resulting workflow may modify files, create recurring jobs, collect data, or perform outbound actions such as sending reports.
- Those actions may continue or produce ...[truncated 812 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the unconditional directive with a consent-based workflow:
- Require the agent to provide an automation proposal before creating or executing anything.
- Clearly enumerate expected file changes, commands, permissions, external services, recurring schedules, and outbound communications.
- Require explicit user approval before writing scripts, modifying configuration, invoking commands, creating scheduled tasks, or sending data.
- Use a preview or dry-run stage and present the expected effects to the user.
- Apply least privilege and restrict generated automation to the directories, systems, and data explicitly authorized by the user.
- Require separate confirmation for persistent or externally visible actions, including scheduled jobs, email delivery, API calls, and system-service changes.
- Provide rollback instructions and require testing in an isolated or limited-scope environment before broader deployment.
- Replace “do it directly without waiting for the user” with language such as: “Offer an automation plan and proceed only after the user explicitly approves its implementation and side effects.”