T01 · Skill Instruction Hijacking
Error
- Location
- references/injection-core.md:1
- Finding
- Mandatory Workflow Injection Alters Agent Goals and Propagates Instructions to Sub-Agents## Vulnerability Details **File Location**: `references/injection-core.md`, lines 1-12 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High The Skill is explicitly designed to install a mandatory workflow into an agent's automatically loaded instruction context. The injected instructions require the agent to perform workflow-specific actions before addressing the user's task, including creating project artifacts, changing task routing, loading persistent state, and propagating a discipline package to sub-agents. **Complete relevant instruction segment, rendered in English from the original source:** ```text # Global Agent Workflow Core — mandatory for every session The hard-loaded core is a workflow routing map. The entire file is written into the platform injection point. Reading it means that injection is active. Startup sequence: 1. Restate the objective and boundaries and emit the required status line. 2. Check the project carrier. If memory/agent-log.md does not exist, create it. If the project rule file does not exist, create it automatically without waiting for permission. If docs/project-info.md is absent in a multi-file project, create it. 3. Read and align with the persistent project memory. 4. Select the mandatory workflow lane. ``` A directly executable session-start template reinforces the same priority: ```bash RULE_FILE="$(pwd)/AGENTS.md" MEMORY_FILE="$(pwd)/memory/agent-log.md" echo "=== shisan-xinuo-workflow · DISCIPLINE ACTIVE ===" echo "" echo "PRIORITY: follow the engineering-governance discipline before starting work." echo " - Triage: L1 fast lane · L2 record · L3 ASK FIRST" echo " - Modes: normal (ask) / goal (autonomous; secrets + destructive ops pause)" echo " - Secrets red line · rollback point before destructive ops · task records" echo " - Never fake completion — label unfinished work." if [ -f "$RULE_FILE" ]; then echo "Rules ...[truncated 2675 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic instruction injection from normal Skill activation. Loading the Skill should affect only the current task. 2. Require explicit, separate, informed consent before modifying any `AGENTS.md`, `CLAUDE.md`, global Rules, memory file, or agent configuration. 3. Present an exact diff of every proposed instruction-file change and require confirmation before writing. 4. Eliminate the requirement to propagate the Skill's instruction package into sub-agent prompts. Pass only task-specific safety constraints needed by the delegated task. 5. Replace mandatory workflow control with optional recommendations that remain subordinate to the active user request and existing project policy. 6. Provide a one-command uninstall procedure that removes only blocks owned by this Skill and restores backed-up configuration safely. 7. Add clear begin and end markers, an installation identifier, and a content hash to every injected block so it can be audited and removed without affecting unrelated rules. 8. Restrict on-demand mode to read-only behavior unless the user explicitly requests project governance artifacts.