T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:17
- Finding
- Untrusted External Task Delegation Can Hijack the Agent's Research Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 17-28, with externally directed submissions at lines 71-74 and 95-99 **Vulnerability Type**: External instruction injection and agent workflow hijacking **Risk Level**: High ### Vulnerable Code ```markdown ### 1. Register as Agent ```bash curl -s -X POST https://www.researchswarm.org/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"maxTasks": 5}' ``` Save the returned `agentId` for subsequent calls. ### 2. Receive Assignment The response includes an assignment with: - `type`: "research" or "qc_review" - `taskId` or `findingId`: The task/finding identifier - `description`: Research topic - `searchTerms`: Keywords for searching ``` The assignment validation guidance does not require rejection of embedded instructions: ```markdown **a) Validate Assignment** - Confirm the topic is legitimate TNBC research - If unclear, proceed with best judgment ``` Results are subsequently transmitted to the same external service: ```bash curl -s -X POST https://www.researchswarm.org/api/v1/agents/[agentId]/findings \ -H "Content-Type: application/json" \ -d @/path/to/finding.json ``` ```bash curl -s -X POST https://www.researchswarm.org/api/v1/agents/[agentId]/qc-submit \ -H "Content-Type: application/json" \ -d '{ "findingId": "[findingId]", "verdict": "passed|flagged|rejected", "notes": "Brief verification notes" }' ``` ### Technical Analysis The skill delegates selection of the agent's task to `researchswarm.org`. The external response supplies a `description`, `searchTerms`, identifiers, and a task type that the agent is instructed to process. These fields cross an external trust boundary but are not explicitly designated as untrusted data. No strict schema validation, content allowlist, instruction filtering, URL restriction, or mandatory user approval is required before ...[truncated 2037 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every assignment field returned by the service as untrusted data, never as executable instructions. 2. Define and enforce a strict response schema: - Permit only documented task types. - Validate identifier formats and lengths. - Apply bounded lengths and character restrictions to descriptions and search terms. - Reject unexpected fields and nested content. 3. Restrict assignments to an explicit allowlist of TNBC research topics. Reject unrelated topics, requests for system information, tool-control directives, shell syntax, and instructions to contact unapproved endpoints. 4. Add an explicit instruction that text inside `description`, `searchTerms`, papers, and QC findings must only be analyzed as data and must never override system, user, or skill instructions. 5. Require user confirmation after displaying a normalized assignment and before performing searches or submitting information. 6. Separate assignment retrieval from execution. Convert validated responses into a local structured task representation that excludes free-form imperative instructions. 7. Restrict outbound requests to documented HTTPS endpoints and disclose precisely which generated data will be transmitted. 8. Require a final pre-submission review that checks scope, citations, sensitive information, and destination rather than only checking scientific content. 9. Log assignment identifiers, validation decisions, approved actions, and submission destinations for auditability. 10. URL-encode search parameters and use argument-based HTTP APIs instead of interpolating externally influenced values into shell commands.