T01 · Skill Instruction Hijacking
Error
- Location
cli2skill/mcp2skill.py:92- Finding
Untrusted CLI and MCP Metadata Is Persisted as Agent Instructions
- Content
View full analysis
str: """Run `executable --help` and capture stdout+stderr.""" # Support multi-word executables like "python script.py" cmd = executable.split() + (args or []) + ["--help"] try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=10, ) return result.stdout or result.stderr ``` `cli2skill/parser.py:65-71`: ```python desc_lines = [] for line in lines: lower = line.strip().lower() if any(lower.startswith(h) for h in section_headers): break if line.strip(): desc_lines.append(line.strip()) meta.description = " ".join(desc_lines[:2]) # Keep first 2 lines max ``` `cli2skill/generator.py:11-25`: ```python # Frontmatter lines.append("---") lines.append(f"name: {meta.name}") desc = meta.description[:100] if meta.description else f"Agent skill for {meta.name} CLI" lines.append(f"description: {desc}") lines.append("user-invocable: false") lines.append(f"allowed-tools: Bash({exe} *)") lines.append("---") lines.append("") # Header lines.append(f"# {meta.name}") lines.append("") if meta.description: lines.append(meta.description) lines.append("") ``` `cli2skill/mcp2skill.py:92-99`: ```python raw_tools = resp["result"].get("tools", []) for t in raw_tools: tools.append(McpTool( name=t.get("name", "unknown"), description=t.get("description", ""), ...[truncated 4002 chars]- Remediation
View remediation