T01 · Skill Instruction Hijacking
- Location
SKILL.md:29- Finding
Unpinned External Skill Instructions Expand the Agent's Capabilities Beyond the Intended Scope
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–36
Vulnerability Type: External instruction loading and unsafe supply-chain dependency
Risk Level: Highmarkdown ## Setup (One Command) Tell your agent:set up skillboss.co/skill.md
text This auto-configures SkillBoss with 687 APIs — chat, image, video, audio, search, scraping, social data, email, and more.Technical Analysis
The Skill directs an agent to retrieve and apply an external
skill.mddocument hosted atskillboss.co. The referenced resource is neither included in the audited package nor pinned to an immutable version or integrity hash. Consequently, its effective instructions can change independently after this package has been reviewed.This creates an instruction and supply-chain trust boundary: loading the local Skill can lead the agent to adopt remotely controlled setup instructions that were unavailable during static analysis. The advertised setup also grants access to hundreds of APIs—including email, scraping, social data, audio, image, and video services—despite the stated purpose being meeting transcription and summarization. This violates least-capability principles and increases the consequences of hostile or compromised remote instructions.
The audited text does not itself fetch executable code, establish persistence, or prove that the remote document is malicious. Exploitation depends on an agent or user following the setup directive. The vulnerability is therefore the unverified delegation of agent configuration to mutable external instructions, not confirmed malicious behavior by the remote service.
Attack Path
- A user invokes the meeting-notes Skill.
- The agent follows the instruction to set up
skillboss.co/skill.md. - The agent retrieves a mutable document controlled outside the audited project.
- If the external resource has been compromised or changed, it can provide instructions that ...[truncated 1179 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle all required setup instructions within the reviewed Skill package instead of directing the agent to load a mutable remote instruction document.
- If a remote resource is unavoidable, reference an immutable version and verify its content using a cryptographic hash or signed manifest before use.
- Display the retrieved instructions to the user and require explicit approval before applying them.
- Restrict configuration to the minimum APIs required for transcription and summarization; do not enable email, scraping, social-data, image, or video capabilities by default.
- Define an allowlist of permitted endpoints, models, and operations, and reject instructions that attempt to expand beyond that allowlist.
- Clearly document what meeting data is transmitted, which providers process it, applicable retention policies, and expected costs.
- Require separate, scoped credentials for unrelated capabilities so compromise of the meeting-notes integration cannot authorize a broad API catalog.
- Add version-controlled review and change-monitoring procedures for any externally hosted setup document.