T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:703- Finding
Mutable Remote Instructions Override Locally Audited Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:703-727
Vulnerability Type: Remote instruction trust and precedence flaw
Risk Level: HighVulnerable Code Snippet
markdown ## Live Schema And Examples Use the compact schema above for ordinary calls. Before a new production integration, or whenever parameters, enum values, nested objects, outputs, or examples are unclear, fetch live details first. - Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "blender-3d-modeling"`. - Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "blender-3d-modeling"`, or call this product with `action: "get_instructions"` when the product tool is already selected. - Treat returned live schema and instructions as more specific than this generated summary. MCP schema lookup through the main AgentPMT MCP server: ```json { "method": "tools/call", "params": { "name": "AgentPMT-Tool-Search-and-Execution", "arguments": { "action": "get_schema", "tool_id": "blender-3d-modeling" } } }For live examples, keep the same MCP tool and use these arguments:
json { "action": "get_instructions", "tool_id": "blender-3d-modeling" }text ### Technical Analysis The Skill instructs the agent to retrieve live textual instructions from an external AgentPMT service and explicitly gives those instructions precedence over the locally packaged and audited summary. Consequently, the effective behavior of the Skill can change after review without any update to the reviewed files. The response from `get_instructions` crosses an external trust boundary. The Skill does not require signature verification, comparison against a pinned version, filtering of behavioral directives, or validation that the response is limited to the declared Blender action schema. A compromised service, account, or upstream instruction record could therefore ret ...[truncated 1740 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction that externally returned prose takes precedence over the locally audited Skill.
- Retrieve only machine-readable schemas needed for compatibility, not open-ended behavioral instructions.
- Validate remote schemas against a pinned local allowlist of action names, fields, types, and endpoint domains.
- Pin remote instruction/schema revisions using an immutable version or content digest and fail closed if verification fails.
- Treat all remote prose as untrusted data. Explicitly prohibit it from changing safety rules, requesting credentials, redirecting calls, or introducing undeclared tools.
- Require explicit user confirmation before enabling capabilities that do not appear in the packaged Skill.
- Log the verified schema version or digest used for each integration without logging credentials or sensitive model data.
- Prefer updating and re-auditing the packaged Skill when behavior changes rather than dynamically overriding it at runtime.