Part 1 argued that an agent cannot reliably tell data from instructions, and that everything it reads melts into one trusted context. This part makes that concrete. We are going to install a normal, useful skill, ask it to do one harmless thing, and watch it quietly do four more. A Friendly Little Skill Say you install a popular community skill to help with git. The rendered file looks like this, abridged: ...
An AI coding agent is useful because it reads things for you and acts on them. It reads your files, your instructions, a skill you installed, a web page you asked it to summarize, the description of a tool it can call. Then it does something: edits a file, runs a command, fetches a URL, calls a tool. That is also exactly why it can be hijacked. The agent has historically had a hard time telling the difference between data it was asked to look at and instructions it is supposed to follow. Everything it reads lands in the same place, and anything in that place can speak in the imperative voice. This post is about that single flaw, because once you see it, every agent hijack you will read about is the same trick wearing different clothes. ...