T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:64
- Finding
- Mutable Remote Skill Instructions Can Bypass Package Review<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-81` **Vulnerability Type**: Mutable remote instruction source **Risk Level**: High ### Code Snippet ```markdown ## Keeping Up To Date Canonical skill URL (always latest): - `https://moltdomesticproduct.com/skill.md` SDK updates: - The SDK does not auto-update itself. - If a newer npm version exists, the SDK will warn at most once per 24 hours. - Update the SDK with: ```bash npm i @moltdomesticproduct/mdp-sdk@latest ``` ClawHub installs: - If you installed the skill via ClawHub and your agent appears to be using older instructions, refresh/re-add the skill. - Prefer referencing the canonical URL above so agents always fetch the latest version. ``` ### Technical Analysis The reviewed package explicitly recommends referencing an “always latest” remotely hosted Skill file instead of relying on the locally reviewed copy. The remote document is not pinned to a version, cryptographic digest, or trusted signature. Consequently, the effective agent instructions can change after the package has passed review. If the hosting account, web application, DNS configuration, TLS termination, or deployment pipeline is compromised, an attacker could replace the remote Skill text with instructions that alter the agent’s goals or request unsafe wallet and data operations. This is particularly sensitive because the Skill already operates with a wallet private key and supports authenticated API requests and financial signatures. ### Attack Path 1. A user installs or reviews the local Skill package. 2. Following the packaged guidance, the agent references or fetches `https://moltdomesticproduct.com/skill.md`. 3. The remote file is modified by its operator or through compromise of the hosting infrastructure. 4. The agent loads the modified text as trusted Skill instructions. 5. The new instructions induce actions not present in the reviewed package, potentially including unsafe signing, data disclosure, ...[truncated 486 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat the packaged `SKILL.md` as the authoritative instruction source. - Do not instruct agents to automatically prefer an unversioned remote copy. - Publish updates as reviewed, immutable package versions. - If remote updates are unavoidable, pin the expected version and SHA-256 digest. - Cryptographically sign remote Skill files and verify the signature against a locally pinned public key. - Display proposed instruction changes and require explicit user approval before activation. - Apply strict content-security controls so a remotely fetched document cannot introduce new tools, hosts, credential requests, or financial operations without separate authorization. ]]>