T01 · Skill Instruction Hijacking
- Location
README.md:505- Finding
Arbitrary Cross-Agent Instruction Injection Through Urgent Messages
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 505–527
Vulnerability Type: Cross-agent prompt and context injection
Risk Level: HighVulnerable Code Snippet
bash ## Cross-Agent Messaging (Tell) Send important messages to other agents: # Send urgent message (injected into recipient's next read) echo "DB schema changed!" > /mnt/avm/tell/kearsarge?priority=urgent # Send normal message echo "FYI: New API deployed" > /mnt/avm/tell/kearsarge # Broadcast to all agents echo "Team meeting at 3pm" > /mnt/avm/tell/@all # Check your inbox cat /mnt/avm/:inbox # Mark all as read cat "/mnt/avm/:inbox?mark=read"text Priority levels: - urgent - Injected into next file read (any file) - normal - Shown in :inbox - low - Only shown when explicitly reading :inboxTechnical Analysis
The documented
urgentmessaging mechanism automatically inserts sender-controlled content into the recipient agent's next file-read result, regardless of which file is read. This mixes data from one trust domain with the output of an unrelated operation and presents it directly in the recipient agent's active context.An attacker with access to the Tell interface could submit content phrased as authoritative instructions rather than an ordinary notification. Because the message is inserted into an arbitrary file read, the recipient may not expect third-party content or distinguish it from trusted file contents. The documentation does not describe provenance labels, sender authorization, content boundaries, recipient confirmation, escaping, or instructions requiring the recipient to treat the inserted message as untrusted data.
The feature exceeds the minimum privileges required for cross-agent messaging. An explicit inbox already supports collaboration without granting senders the ability to modify the apparent result of unrelated reads.
Attack Path
- An attacker gains legitimate or compromised access to an agent identity that ...[truncated 1586 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic insertion of urgent messages into file-read results.
- Deliver all cross-agent messages through a separate, explicitly requested inbox or typed messaging channel.
- Return structured metadata with every message, including sender identity, timestamp, priority, authorization status, and a clear untrusted-content marker.
- Require recipients to explicitly retrieve or approve urgent messages before including them in an agent context.
- Enforce per-recipient access-control lists so only authorized identities can send messages.
- Prevent broadcasts by default and require a dedicated capability for access to
@all. - Treat message bodies strictly as untrusted data and ensure they are never concatenated with system instructions, tool responses, or file contents.
- Apply message length limits, rate limits, quotas, replay protection, and comprehensive audit logging.
- Provide agents with explicit guidance that message content must not override system, developer, user, or security instructions.
- Add adversarial tests covering instruction-like messages, impersonation, broadcasts, privilege differences between agents, and attempts to induce sensitive tool calls.