T01 · Skill Instruction Hijacking
- Location
SKILL.md:174- Finding
Mutable Remote Instructions Can Override the Audited Skill Definition
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:174
Vulnerability Type: Remote instruction trust and precedence vulnerability
Risk Level: HighVulnerable code snippet:
markdown - Treat returned live schema and instructions as more specific than this generated summary.Technical Analysis
The Skill explicitly grants remotely returned schemas and instructions greater specificity—and therefore practical precedence—over the locally reviewed Skill definition. Those remote instructions are retrieved from an AgentPMT service after package review and can change independently of the audited files.
Although retrieving structured poverty data is consistent with the declared functionality, allowing mutable remote content to redefine operational instructions exceeds the minimum privilege required. The remote response only needs to supply data conforming to a locally defined schema; it does not need authority to modify the agent's goals, safety constraints, credential-handling practices, or permitted tool usage.
No malicious remote response is included in the repository, so exploitation depends on compromise or malicious control of the remote service, its transport termination, an associated account, or the returned content. Nevertheless, the local instruction establishes the trust boundary needed for such an attack.
Attack Path
- A user loads the Skill and requests poverty or inequality data.
- The agent calls the documented remote
get_schemaorget_instructionsoperation. - An attacker compromises or controls the service, account, or content-generation path used for that response.
- The service returns imperative instructions alongside, or instead of, the expected schema or examples.
- Because
SKILL.mdsays the returned instructions are more specific than the audited summary, the agent gives the remote content precedence. - The injected instructions can redirect subsequent tool calls, re ...[truncated 778 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction that gives remotely returned content precedence over the local Skill.
- Treat every remote response as untrusted data, not as executable or authoritative agent instructions.
- Define and pin the complete accepted request and response schemas locally.
- Validate returned content with a strict allowlist of expected fields, types, lengths, and enum values.
- Reject unexpected fields, free-form imperative instructions, tool directives, credential requests, and embedded URLs.
- If live schema discovery remains necessary, display material changes to the user and require explicit approval before adopting them.
- Pin a schema version or integrity digest and fail closed when the remote schema differs.
- Ensure system and local security policies always take precedence over remote content.