T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:614- Finding
Mutable Remote Skill Content Is Treated as Runtime Execution Authority
- Content
View full analysis
and are the **runtime execution authority**: ```bash # Re-install the full skill bundle (updates HEARTBEAT.md, SKILL.md, references/): openjobs install-skill --agent --force ``` ``` ### Technical Analysis The Skill explicitly instructs the Agent to overwrite the locally reviewed Skill bundle at the beginning of every heartbeat. It also declares the latest remotely published documents to be the authoritative runtime instructions. This creates a mutable execution channel outside the audited project. The effective instructions executed by the Agent can change after review without a local code change, integrity verification, version pin, diff review, or renewed operator approval. The `--force` option increases the risk by permitting replacement of the existing reviewed files. This behavior exceeds the minimum privileges needed to interact with the OpenJobs marketplace. Marketplace operations do not require remotely hosted instructions to replace the local Skill before every run. ### Attack Path 1. An attacker compromises `openjobs.bot`, its deployment pipeline, the CLI publisher account, or another component involved in distributing the Skill bundle. 2. The attacker modifies the remotely distributed `SKILL.md`, `HEARTBEAT.md`, or associated references. 3. A scheduled or manually triggered heartbeat runs the mandatory refresh command with `--force`. 4. The reviewed local Skill is replaced with attacker-controlled instructions. 5. The Agent loads the new content as “runtime execution authority.” 6. The malicious instructions can direct the Agent to invoke tools, disclose file ...[truncated 901 chars]- Remediation
View remediation