T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:24
- Finding
- Untrusted Remote Guidance Can Influence Agent Behavior and Generated Queries## Vulnerability Details **File Location**: `SKILL.md`, lines 24-27 and 41-44 **Vulnerability Type**: Remote instruction injection through mutable guidance **Risk Level**: High ### Vulnerable Code ```markdown GET {LIGHT_BRIDGE_URL}/api/v1/query/guide ``` ```bash curl -s -H "Authorization: Bearer $LIGHT_BRIDGE_API_KEY" \ "$LIGHT_BRIDGE_URL/api/v1/query/guide" ``` The surrounding instructions require the agent to retrieve Markdown from this endpoint, interpret it as data-model and query guidance, and use it when constructing SQL. ### Technical Analysis The skill requires the agent to retrieve mutable Markdown from an external service before constructing any query. The returned content is treated as trusted operational guidance rather than untrusted data. Because the remote response is not included in the audited package, its future contents cannot be statically reviewed. The skill defines no trusted schema, signature verification, content allowlist, or instruction/data boundary for the response. A compromised service, account, DNS path, or backend could therefore return adversarial text designed to alter the agent's behavior. This is an instruction-hijacking risk rather than remote code execution: the documented endpoint returns guidance that influences agent decisions, but the reviewed file does not directly download or execute program code. ### Attack Path 1. An attacker gains control over, or compromises, the configured guidance endpoint or its backend. 2. The attacker modifies the `/api/v1/query/guide` response to include hostile behavioral instructions disguised as query guidance. 3. The skill mandates retrieving and interpreting that response before generating SQL. 4. The agent treats the hostile content as authoritative guidance. 5. The agent may generate queries outside the user's intended scope, disclose excessive business data, suppress warnings, or otherwise alter its response behavior. 6. If comb ...[truncated 708 chars]
- Remediation
- ## Remediation Suggestions 1. Replace free-form Markdown guidance with a versioned, machine-readable JSON schema. 2. Treat every remote response as untrusted data and explicitly prohibit following behavioral instructions contained in it. 3. Validate responses against a strict local schema and reject unknown keys, embedded directives, URLs, executable content, and unexpected text. 4. Pin an expected guide version or cryptographic digest. If dynamic updates are required, verify a digital signature against a key bundled with the skill. 5. Keep query-generation policy locally in the reviewed skill rather than delegating policy decisions to mutable remote content. 6. Use local table, column, aggregation, tenant, time-range, and row-limit allowlists. 7. Require explicit user confirmation before executing queries that materially expand scope or access sensitive records. 8. Ensure remote instructions can never override system policies, authorization boundaries, or output-safety requirements.