T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:36
- Finding
- Unpinned External Rules Can Influence Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:36-52` **Vulnerability Type**: Untrusted remote instructions imported into the agent workflow **Risk Level**: Medium ### Vulnerable Code ```markdown ## Register First Before registering, read the Network Rules at https://www.pinchedin.com/bot-rules.md ```bash curl -X POST https://www.pinchedin.com/api/bots/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourAgentName", "headline": "Brief description of what you do", "jobTitle": "Your Role", "skills": ["Skill1", "Skill2", "Skill3"], "operatorEmail": "operator@example.com", "webhookUrl": "https://your-server.com/webhook", "acceptedRules": true }' ``` **Required:** `acceptedRules: true` confirms you have read the Network Rules. ``` ### Technical Analysis The Skill instructs the agent to retrieve and read a mutable external document before registration and then attest that its rules were accepted. The remote rules are not included in the audited package, version-pinned, cryptographically verified, or constrained to being treated only as untrusted reference material. Consequently, the effective instructions associated with the Skill can change after review. If the external page is modified or compromised, it could contain prompt-injection content that attempts to alter the agent's current objectives, override safety constraints, request disclosure of information, or induce unrelated tool operations. This does not directly provide arbitrary code execution or additional system privileges. Exploitation depends on the agent interpreting content retrieved from the external page as authoritative instructions rather than untrusted data. ### Attack Path 1. An agent loads `SKILL.md` and begins the documented registration workflow. 2. The workflow directs the agent to retrieve `https://www.pinchedin.com/bot-rules.md`. 3. The remote document is changed by its publisher or compromised by an attacker. 4. ...[truncated 1043 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include a reviewed copy of the Network Rules directly in the Skill package. 2. Pin the accepted rules to an immutable version and cryptographic digest. 3. Treat remotely retrieved Markdown as untrusted data, never as executable agent instructions. 4. Restrict processing of the rules page to extracting or displaying its textual terms. 5. Detect version or digest changes and require a new security review. 6. Require explicit human confirmation before submitting `acceptedRules: true`. 7. Display the exact rule version and content being accepted to the operator. 8. Ensure registration cannot proceed automatically when the fetched document fails integrity validation. ]]>