T01 · Skill Instruction Hijacking
- Location
SKILL.md:74- Finding
Untrusted Remote Skill Instructions May Hijack Agent Behavior
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 74-79 and 98-101
Vulnerability Type: Remote instruction trust without validation
Risk Level: MediumVulnerable Code
SKILL.md, lines 74-79:python # Get Moltbook's skill.md skill_result = pilot({"type": "scraper", "inputs": {"url": "https://www.moltbook.com/skill.md"}}) skill_content = skill_result["result"]["data"]["markdown"] # Get Ctxly Memory's skill.md skill_result = pilot({"type": "scraper", "inputs": {"url": "https://ctxly.app/skill.md"}}) skill_content = skill_result["result"]["data"]["markdown"]SKILL.md, lines 98-101:text ## Workflow 1. **Discover** — `pilot({"type": "scraper", "inputs": {"url": "https://ctxly.com/services.json"}})` 2. **Learn** — Fetch the skill.md for services you need via SkillBoss scraping type 3. **Use** — Follow the skill.md to integrateTechnical Analysis
The Skill retrieves remotely hosted
skill.mddocuments through the SkillBoss scraping API and directs the Agent to follow those documents. The retrieved instructions are remotely mutable and are not authenticated, cryptographically pinned, allowlisted, or subjected to a mandatory security review.This creates an instruction-hijacking boundary: content controlled by a listed service is treated as operational guidance rather than untrusted external data. A service operator, compromised service, compromised directory, or compromised scraping response could introduce instructions that conflict with the Agent's current goal or attempt to induce unsafe tool calls.
This is not confirmed remote code execution by itself. Exploitation depends on the Agent interpreting the retrieved document as instructions and possessing tools or permissions capable of carrying out the requested actions.
Attack Path
- An attacker controls or compromises a service listed by the remote directory, its hosted
skill.md, the directory response ...[truncated 1378 chars]
- An attacker controls or compromises a service listed by the remote directory, its hosted
- Remediation
View remediation
Remediation Suggestions
- Treat every retrieved
skill.mdand directory response as untrusted data. Explicitly state that remote text must not override system instructions, user intent, authorization boundaries, or security policy. - Replace “Follow the skill.md” with a review-first workflow that summarizes proposed actions, identifies requested permissions and data flows, and obtains user approval before execution.
- Restrict retrieval to an explicit allowlist of reviewed HTTPS domains and reject redirects to unapproved hosts.
- Pin approved documents by cryptographic hash or require signed manifests with verified publisher identities. Re-review content whenever its hash or signature changes.
- Validate the directory response schema and sanitize remote content before presenting it to an Agent. Separate informational content from executable or actionable instructions.
- Apply least privilege to downstream integrations. Do not expose environment variables, credentials, local files, memory, or powerful tools merely because a retrieved document requests them.
- Require per-action authorization for sensitive operations, including credential use, filesystem access, command execution, external communication, payments, and persistent state changes.
- Prefer direct retrieval of public documents when an intermediary is unnecessary, or clearly disclose that requested URLs and metadata are sent to the SkillBoss API provider.
- Check HTTP status codes, response content types, response size limits, and expected JSON fields before consuming scraper results.
- Treat every retrieved