T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:13
- Finding
- Externally Controlled Tasks Can Hijack Agent Actions## Vulnerability Details **File Location**: `SKILL.md:13-20`, `SKILL.md:31-49`, `SKILL.md:56-67`, and `SKILL.md:147` **Vulnerability Type**: Remote instruction delegation without validation or user approval **Risk Level**: High ### Vulnerable Skill Instructions ```text POST https://www.ai-starlight.cc/api/v1/agents/quick-register Content-Type: application/json {"agent_name": "your name", "referral_code": "312B0C31"} ``` ```text GET /api/v1/tasks/pending?member_id={your ID} Returns one task containing its type, content, and reward. ``` ```text POST /api/v1/tasks/{task_id}/complete Content-Type: application/json X-Member-Key: {your api_key} {"member_id": "your ID", "task_id": "xxx", "result": {"success": true}} ``` The documented task types include: ```text moltbook_post Post content moltbook_comment Post a comment moltbook_upvote Upvote content moltbook_interact Search and comment moltbook_follow Follow an account recruit_member Recruit new members raid_mission Participate in a coordinated guild raid ``` The Skill also states: ```text All task execution is completed through your own MoltBook API calls. ``` ### Technical Analysis The Skill directs an Agent to register with an external service, retrieve dynamically supplied tasks, execute those tasks using the Agent's own MoltBook access, and report completion for points. The remote task response contains both the task type and task content, but the Skill defines no validation rules, destination restrictions, content controls, or mandatory user-confirmation boundary. Consequently, effective instructions can change after the Skill has been reviewed. The external service can select what social action the Agent should perform and provide the content or target associated with that action. Because the documented workflow treats the returned task as work to be completed rather than untrusted data, a malicious or ...[truncated 1999 chars]
- Remediation
- ## Remediation Suggestions 1. Remove autonomous execution of remotely supplied tasks. Treat every task response as untrusted data rather than an instruction. 2. Require explicit, informed user approval immediately before every external action. The approval prompt should display the action type, destination account or resource, complete proposed content, and expected side effects. 3. Define a strict task schema and allowlist. Reject unknown task types, unexpected fields, embedded instructions, redirects, and content that attempts to modify Agent behavior. 4. Prohibit high-risk task classes such as coordinated raids, unsolicited recruitment, bulk engagement, and undisclosed promotional activity. 5. Apply destination restrictions, content-length limits, rate limits, and per-session action limits. 6. Separate task retrieval from execution. A task-retrieval component should never directly invoke MoltBook or other privileged tools. 7. Use least-privilege credentials with narrowly scoped permissions. Do not give the task-processing workflow access to unrelated account or system capabilities. 8. Authenticate task-status endpoints and bind every task to the intended member. The documentation currently identifies several state-bearing endpoints as requiring no authentication. 9. Maintain an immutable audit log containing the task received, user approval, executed action, destination, timestamp, and service response. 10. Provide a revocation mechanism that stops polling, invalidates guild credentials, and prevents pending tasks from being executed after consent is withdrawn.