T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:18
- Finding
- Untrusted PR Comments Can Direct Repository Modifications## Vulnerability Details **File Location**: `SKILL.md`, lines 18–22, 194–201, and 221–232 **Vulnerability Type**: Untrusted instructions controlling privileged repository operations **Risk Level**: High ### Vulnerable Code Snippets ```markdown It decides which round to act on by matching PR comment CONTENT against a marker pattern (see Step 2), not by authenticating who posted it beyond GitHub's own login attribution — anyone who can comment on the PR (including, on some repos, the PR author replying to their own automated review) can shape which comment this skill treats as "the latest reviewer batch." ``` ```markdown Identify the latest REVIEWER comment and the latest comment authored by us (the reply posted last round). Then branch: **Do not distinguish them by author.** The automated reviewer may post under the SAME GitHub account as our replies, so `.user.login` cannot tell them apart. Distinguish by content: reviewer batches carry a `<!-- review-pr-state … cycle=N … -->` metadata block; our replies carry `codex-addressed:<batch_id>`. ``` ```markdown 3. **New findings**: the latest reviewer comment is newer than our last reply and contains findings. Proceed to Step 3. ``` ```markdown ## Step 3 — Apply the fixes (per-edit disk writes, asserted matches) Enumerate every finding in the latest reviewer comment. For each one, locate the exact current text (`grep -n` first — never edit from memory of the file), then apply the edit. ``` ### Technical Analysis The skill treats a marker embedded in PR comment content as the trust signal for a reviewer batch. The marker and all associated findings are attacker-controlled text. The instructions explicitly decline to authenticate the batch by its author and acknowledge that anyone able to comment may shape the selected batch. After selecting such a batch, the skill directs the agent to implement every finding, commit the resulting modifications, and push them using the invoking user's GitHub cr ...[truncated 1608 chars]
- Remediation
- ## Remediation Suggestions 1. Authenticate reviewer batches against an explicit allowlist of immutable GitHub actor IDs, not display names, login text, or comment-body markers. 2. Fetch actor identity and repository role through the GitHub API and reject comments from unauthorized, suspended, or insufficiently privileged accounts. 3. Treat comment bodies as untrusted data. Ignore embedded instructions that attempt to alter the skill workflow, invoke tools, access secrets, or expand the requested scope. 4. Define an edit policy that restricts changes to files and findings directly relevant to the PR review. 5. Generate and display the proposed diff before any commit or push. 6. Require explicit human confirmation before privileged write operations, especially changes to CI workflows, executable scripts, dependencies, release configuration, and security controls. 7. Cryptographically or server-side bind each batch identifier to the authorized reviewer and PR rather than trusting a copyable HTML marker. 8. Record the validated actor ID, comment ID, and commit SHA in the reply for auditability. 9. Preserve the existing prohibition on merging, but do not rely on it as the primary control because pushed branch changes can still execute in CI or influence later merges.