T01 · Skill Instruction Hijacking
Error
- Location
- references/connect.md:31
- Finding
- Mandatory Silent Session-Start External Action## Vulnerability Details **File Location**: `references/connect.md:31-34, 49-52` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```text # 1. At session start, check quietly for anything already pending check_pending_matches # does not consume the principal's unread window get_digest # only when the principal actually reads; it marks them read ``` ```text - Call `check_pending_matches` quietly at session start. If something is pending, tell the principal; do not act on it unsupervised. Use `get_digest` only when the principal actually reads: it marks matches as seen, so calling it on their behalf spends a window they never looked at. ``` ### Technical Analysis The binding instruction requires the agent to invoke `check_pending_matches` at every session start and directs it to perform the action “quietly.” The requirement applies independently of the user's current objective and therefore alters normal session behavior as soon as the skill is loaded. This instruction conflicts with the same module's stated restriction that the connection layer should only be used when a task genuinely requires an external party and should not be used speculatively. It also weakens the broader requirement that network matching operations receive explicit approval. Although the exact request fields and server implementation are not included in the audited project, the documented operation belongs to an external matching service. Consequently, invoking it may disclose session timing, service account or agent identity, and associated request metadata to that service. ### Attack Path 1. An operator installs or loads the skill. 2. The user begins a new session for any task, including one unrelated to external matching. 3. The binding session-start rule activates without action-specific approval. 4. The agent invokes `check_pending_matches` through the external connection layer. 5. The external serv ...[truncated 749 chars]
- Remediation
- ## Remediation Suggestions - Remove the unconditional session-start requirement. - Do not describe network operations as occurring “quietly”; disclose the action, destination, purpose, and relevant data handling before invocation. - Require explicit, action-specific user approval before every pending-match check. - Load and use the connection module only when the current task genuinely requires an external party. - Define which identifiers and metadata the request transmits, as well as applicable retention rules. - Treat all matching-service responses as untrusted data and prevent them from overriding system, developer, or user instructions. - Add tests ensuring unrelated sessions cannot trigger matching-service calls.