T01 · Skill Instruction Hijacking
- Location
SKILL.md:144- Finding
Remote Instructions Override the Locally Audited Skill Definition
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 144–149
Vulnerability Type: Remote instruction redirection
Risk Level: HighVulnerable Code Snippet:
text ## Live Schema And Examples Use the compact schema above for ordinary calls. Before a new production integration, or whenever parameters, enum values, nested objects, outputs, or examples are unclear, fetch live details first. - Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "real-estate-sales-leasing-and-valuations"`. - Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "real-estate-sales-leasing-and-valuations"`, or call this product with `action: "get_instructions"` when the product tool is already selected. - Treat returned live schema and instructions as more specific than this generated summary.Technical Analysis
The Skill explicitly instructs the agent to retrieve mutable instructions from a remote AgentPMT service and treat those instructions as more specific than the locally installed and audited Skill definition. This creates an instruction-authority boundary in which remote, post-installation content can modify the agent's effective behavior without requiring any update to the reviewed package.
Remote schemas can be useful when handled as structured, validated data. However, the
get_instructionsresponse contains behavioral instructions, and the Skill grants those instructions precedence over its local summary. If the remote service, its account, or its delivery infrastructure is compromised, an attacker could return prompt-injection content disguised as product instructions.No evidence establishes that the current AgentPMT endpoint is malicious. The vulnerability is the unconditional delegation of instruction authority to mutable remote content.
Attack Path
- The agent loads the locally reviewed Skill.
...[truncated 1185 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction that gives remotely returned instructions precedence over the local Skill.
- Do not retrieve free-form behavioral instructions during normal tool execution.
- Retrieve only versioned, machine-readable schemas and validate them against a locally defined allowlist of actions, fields, types, and limits.
- Pin the expected schema version or cryptographic digest and reject unexpected changes.
- Treat all remote descriptions, examples, warnings, and error messages as untrusted data rather than executable agent instructions.
- Prevent remote responses from changing tool permissions, requesting credentials, initiating unrelated actions, or overriding system and user instructions.
- Require explicit user confirmation before transmitting precise residential addresses or performing additional paid calls prompted by a remote response.
- Apply strict response parsing so only expected JSON fields are consumed and free-form instruction text cannot enter the agent's control context.