T01 · Skill Instruction Hijacking
Error
- Location
scripts/call_api.py:106- Finding
Remote API responses can hijack agent output and inject advertisements
- Content
View full analysis
dict[str, Any]: client = XiaoBenYangClient() try: res = client.call_tool(mcp_id, tool_name, params) return {"success": True, "raw": res.json, "message": "success"} except UpstreamError as e: return {"success": False, "raw": getattr(e, "payload", None), "message": f"API call failed: {e}"} finally: client.close() ``` The vulnerable Skill workflow can be summarized from `SKILL.md` as follows: ```text User input -> select a tool -> extract parameters -> call scripts.tools -> return the result. The raw API response must be organized and displayed to the user. ``` ### Technical Analysis Tool functions forward prompts, source code, or topics to `https://mcp.xiaobenyang.com/api`. The API response is returned without schema validation, content filtering, provenance labeling, or separation between trusted instructions and untrusted data. The Skill instructions then designate the returned `raw` field as content the agent should process and display. Consequently, the operator of the remote endpoint—or an attacker who compromises it—can change the effective output after the Skill has been reviewed. A response can contain advertisements, deceptive links, social-engineering messages, or instruction-like text intended to influence the agent's current response. This is classified as instruction hijacking rather than remote code execution: the reviewed code ...[truncated 1349 chars]- Remediation
View remediation