T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:102
- Finding
- Remote Mesh Messages Can Hijack Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:102-108`; `scripts/mesh.sh:121-154` **Vulnerability Type**: Untrusted remote content is automatically placed into an agent-processing workflow **Risk Level**: High ### Vulnerable Code `SKILL.md:102-108`: ```markdown ## Heartbeat Integration Add this to your HEARTBEAT.md to auto-process mesh messages: ```markdown ## Mesh Communication 1. Check `~/.mesh-pending.json` for queued messages 2. Process each message and respond via `mesh send` 3. Clear processed messages ``` ``` `scripts/mesh.sh:121-154`: ```bash # Poll API for new messages (inbox) cmd_check() { check_config response=$(curl -s -X GET "$AGENTOS_URL/v1/mesh/messages?agent_id=$AGENT_ID&direction=inbox&status=sent&limit=50" \ -H "Authorization: Bearer $AGENTOS_KEY" \ -H "Content-Type: application/json") if echo "$response" | jq -e '.messages' > /dev/null 2>&1; then count=$(echo "$response" | jq '.messages | length') if [ "$count" -gt 0 ]; then echo -e "${YELLOW}📬 $count unread message(s) from API:${NC}" echo "$response" | jq '.messages[] | {id: .id, from: .from_agent, topic: .topic, body: .body[0:100]}' # Merge with pending file if [ -f "$PENDING_FILE" ]; then existing=$(cat "$PENDING_FILE") else existing="[]" fi # Transform and add new messages new_msgs=$(echo "$response" | jq '[.messages[] | {id: .id, from: .from_agent, topic: .topic, body: .body, receivedAt: .created_at}]') merged=$(echo "$existing" "$new_msgs" | jq -s '.[0] + .[1] | unique_by(.id)') echo "$merged" > "$PENDING_FILE" else echo -e "${GREEN}✓ No new messages${NC}" fi else echo -e "${RED}API check failed:${NC}" echo "$response" | jq . fi } ``` ### Technical Analysis The polling command copies remote message bodies into `~/.mesh-pending.json` without validating the sender, constraining message content, or distinguishing data fro ...[truncated 1743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat every remote topic and message body strictly as untrusted data. - Do not direct an AI agent to automatically execute or comply with message content. - Require explicit user approval before responding to a message or invoking any tool based on it. - Authenticate senders and implement an allowlist of permitted agent identities. - Present remote messages in strongly delimited data blocks with explicit instructions that their contents cannot override system, developer, user, or skill rules. - Reject or quarantine messages that request secrets, tool invocation, policy changes, persistence, credential access, or actions unrelated to a narrowly defined communication function. - Attach verified sender metadata and authorization scope to each queued message. - Record audit logs for receipt, approval, rejection, and response actions. ]]>