T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:72
- Finding
- Runtime Retrieval of Untrusted Operational Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 72-80 **Vulnerability Type**: Remote instruction-control channel **Risk Level**: Medium ### Vulnerable Code ```markdown ## Full Agent Guide At the start of any investigation, fetch the full agent guide for complete workflows, scripts, operational instructions, and detailed endpoint specs: ``` GET ${INGESTIGATE_BASE_URL}/api/agent/guide Authorization: Bearer ${INGESTIGATE_TOKEN} ``` Use it as the primary reference for all non-trivial tasks. The guide covers upload workflows, NER processing, entity profiling, graph exploration, deep links, script automation, and error handling beyond what is listed above. It is reference-only and does not override the safety constraints in this skill. ``` ### Technical Analysis The Skill requires the agent to retrieve a remotely hosted guide at the beginning of every investigation and use it as the primary reference for non-trivial tasks. Because the guide is supplied at runtime, its contents can change after the static Skill package has been audited. The statement that the guide cannot override safety constraints is useful but does not technically isolate the retrieved content from the agent's instruction context. A malicious or compromised server could return instructions that attempt to alter workflows, solicit additional information, invoke unnecessary endpoints, upload data, or otherwise influence tool use. The endpoint origin is controlled through `INGESTIGATE_BASE_URL`. The Skill does not prescribe an HTTPS hostname allowlist or certificate pinning. Consequently, a misconfigured or attacker-controlled base URL could receive the bearer token and return hostile operational instructions. The authenticated network transfer itself is expected for this hosted service, but mandatory remote instruction retrieval exceeds what is necessary for the core workflows already documented locally. This also conflicts with `README.md`, where retrieval of the fu ...[truncated 2045 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to fetch the remote guide at the start of every investigation. Keep security-sensitive workflows and endpoint specifications in the reviewed Skill package. 2. Make remote guide retrieval optional and require explicit user approval before retrieving or relying on it. 3. Treat downloaded documentation as untrusted reference data, not as authoritative agent instructions. Explicitly prohibit it from adding tools, changing safety rules, requesting secrets, or expanding the task's scope. 4. Validate `INGESTIGATE_BASE_URL` against an allowlist of approved HTTPS origins before sending the bearer token. Reject embedded credentials, non-HTTPS schemes, unexpected ports, redirects to other origins, and malformed URLs. 5. Do not forward the Authorization header across cross-origin redirects. Prefer disabling redirects for authenticated requests or validating every redirect target against the same allowlist. 6. Define locally which API operations are permitted. Require separate user confirmation for sensitive actions such as document uploads, modifications, deletions, or bulk retrieval. 7. Apply response size and content-type limits to the guide endpoint, and separate retrieved reference material from the agent's governing instruction hierarchy. 8. Reconcile the documentation so that `SKILL.md` and `README.md` consistently describe remote guide retrieval as optional. 9. Continue using short-lived, narrowly scoped tokens, and revoke or rotate a token immediately if an unapproved endpoint may have received it. ]]>