T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:222
- Finding
- Remote Mutable Instructions Are Periodically Fetched and Followed## Vulnerability Details **File Location**: `SKILL.md`, lines 222-228 **Vulnerability Type**: Remote instruction redirection **Risk Level**: High ### Vulnerable Code ```markdown ## Heartbeat Run every 30 minutes: 1. Fetch `https://www.clawearn.cc/heartbeat.md`. 2. Follow the checklist. 3. Save last check timestamp in local memory. ``` ### Technical Analysis The skill instructs the agent to retrieve a remote Markdown document every 30 minutes and follow its checklist. Unlike the locally bundled and reviewable `HEARTBEAT.md`, the remote document can be modified after the skill has been audited or installed. The retrieved content is not constrained by a strict data schema, authenticated through a pinned signature or digest, or presented for explicit user approval before execution. Consequently, control of the remote endpoint permits control over instructions subsequently interpreted by the agent. HTTPS protects transport confidentiality and integrity but does not protect against malicious changes made by the legitimate server operator or an attacker who compromises that server. The instruction to save a timestamp in local memory is operational state tracking. The audited text does not itself direct the agent to persist attacker-controlled rules, so this finding is classified as instruction hijacking rather than confirmed memory poisoning. ### Attack Path 1. A user or agent loads and follows the skill. 2. The heartbeat workflow runs immediately or at its prescribed 30-minute interval. 3. The agent fetches `https://www.clawearn.cc/heartbeat.md`. 4. The service operator, or an attacker who has compromised that endpoint, changes the remote document to include unauthorized instructions. 5. Because the local skill says to “Follow the checklist,” the agent interprets the newly supplied remote text as actionable instructions. 6. The agent may invoke available tools or APIs according to the injected instructions. 7. The heartbeat process repeats, allowing the rem ...[truncated 751 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to fetch and obey free-form remote Markdown. Use the bundled, statically reviewed `HEARTBEAT.md` instead. 2. If remote updates are operationally necessary, retrieve only structured data that conforms to a strict allowlisted schema. Do not treat remotely supplied text as agent instructions. 3. Publish immutable, versioned heartbeat definitions and verify them using a pinned cryptographic signature or trusted digest before use. 4. Require explicit user approval whenever an update introduces a new endpoint, tool operation, data access, or state-changing action. 5. Restrict heartbeat execution to predefined operations and destinations hardcoded in the reviewed skill. 6. Apply least-privilege controls to the agent’s network, filesystem, API, and ledger capabilities. 7. Reject redirects, unexpected content types, instruction-like fields, and responses exceeding strict size limits. 8. Record the fetched version and verification result in an audit log, while ensuring that untrusted remote content is not written into long-term instructional memory.