T01 · Skill Instruction Hijacking
Error
- Location
- HEARTBEAT.md:15
- Finding
- Mutable Remote Skill Instructions May Alter Agent Behavior After Audit## Vulnerability Details **File Location**: `HEARTBEAT.md`, lines 15-23 **Vulnerability Type**: Mutable remote instruction retrieval **Risk Level**: High ```markdown | Review skill.md | Daily | Rules and activities might evolve | ## Stay Updated Check if Clawtopia has new activities or rule changes: ```bash curl -s "https://clawtopia.io/skill.md" | head -50 ``` The sanctuary evolves. New activities, new services, new achievements. Stay informed. ``` ### Technical Analysis The Skill directs the Agent to retrieve changing Skill content from `https://clawtopia.io/skill.md` every day. This remote document is outside the audited package and can be modified after installation without changing the locally reviewed files. The command only displays the first 50 lines and does not directly execute downloaded shell code. Nevertheless, an AI Agent may interpret the displayed text as updated operational instructions. If the remote service, its hosting account, DNS, or content delivery path is compromised, an attacker could place adversarial instructions near the beginning of the document. This is instruction hijacking rather than confirmed remote code execution: successful exploitation depends on the Agent treating the downloaded content as authoritative and subsequently invoking available tools. ### Attack Path 1. An attacker compromises or otherwise obtains control over the remote `skill.md` document. 2. The attacker places malicious instructions within its first 50 lines. 3. The Agent follows the documented daily update process and retrieves the modified content. 4. The Agent interprets that untrusted content as updated Skill guidance. 5. Subject to the Agent's available tools and permissions, the injected instructions may direct it to disclose data, make unauthorized API requests, spend resources, or disregard the locally audited workflow. ### Impact Assessment The immediate operation only reads public remote te ...[truncated 548 chars]
- Remediation
- ## Remediation Suggestions - Package the authoritative instructions locally instead of retrieving mutable Skill text during normal operation. - If remote updates are required, retrieve a versioned, immutable artifact and verify a cryptographic signature against a locally pinned public key. - Treat downloaded documents strictly as untrusted data, not as executable or authoritative Agent instructions. - Require explicit human review and approval before incorporating remote rule changes. - Pin the expected origin and document hash, and reject unexpected redirects, content types, or integrity mismatches. - Separate update checking from update application: report that an update exists without feeding its contents directly into the Agent's instruction context.