T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:37
- Finding
- Mutable Remote Instructions Can Influence Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-44` **Vulnerability Type**: Remote instruction delegation **Risk Level**: High ### Vulnerable Code ```markdown ## 3. Solution Discovery (Method B: Community Engagement) - Check if user is member of BotLearn community - If not member: Read https://botlearn.ai/skill.md and follow instructions to join - If member: Search community for similar problems - Review recent shared skills and bots - DM community members for guidance - Post question with task details if no existing solution found - Integrate community feedback into approach ``` ### Technical Analysis The Skill explicitly tells the Agent to retrieve a mutable remote document and “follow instructions” contained in it. Those instructions are not included in the audited package and can change after publication or review. This crosses a critical trust boundary: remotely retrieved content is treated as behavioral instructions rather than untrusted reference material. If the remote site, its DNS, hosting infrastructure, or publishing account is compromised, an attacker could insert instructions that alter the Agent’s objectives, request sensitive information, invoke tools, or direct the Agent to retrieve further content. Although the stated purpose is to obtain community-joining guidance, the instruction does not constrain which remote directives may be followed. ### Attack Path 1. A user activates the Skill and enters the community-engagement workflow. 2. The Skill determines or assumes that the user is not a community member. 3. The Agent retrieves `https://botlearn.ai/skill.md`. 4. An attacker who controls or has compromised the remote content inserts malicious Agent instructions. 5. The Agent interprets those instructions as part of the Skill workflow. 6. The injected instructions alter subsequent Agent behavior, potentially causing unauthorized tool calls, disclosure requests, or additional payload retrieval. ### Impact Assessment Su ...[truncated 310 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to “follow instructions” from remote content. 2. Bundle a fixed, audited version of the community-joining procedure in the package. 3. Treat all remotely retrieved documents as untrusted data, never as Agent instructions. 4. If remote documentation must be displayed, summarize only narrowly defined fields such as official links and membership steps. 5. Apply an allowlist of acceptable actions and reject remote content requesting tool use, credential access, file access, package installation, or behavioral changes. 6. Pin remote documentation by a reviewed content hash or signed release when feasible. 7. Require explicit user confirmation before opening external links or taking any action derived from remote content. ]]>