T01 · Skill Instruction Hijacking
Error
- Location
- cli.js:1225
- Finding
- Untrusted XMTP task content is automatically passed to privileged local coding agents<![CDATA[ ## Vulnerability Details **File Location**: `cli.js:1225-1239`; `src/executor.js:176-219`; `src/executor.js:412-424` **Vulnerability Type**: Prompt injection through untrusted network task content **Risk Level**: High ### Vulnerable Code ```js // cli.js:1225-1239 for (const m of msgs) { if (seenMessages.has(m.id)) continue; seenMessages.add(m.id); if (m.senderInboxId === agent.client.inboxId) continue; try { const parsed = JSON.parse(typeof m.content === 'string' ? m.content : JSON.stringify(m.content)); if (parsed?.type === 'task') { console.log(`[TASK from private group] "${parsed.title}"`); const { execute } = await import('./src/executor.js'); const result = await execute(parsed, config); const { sendProtocolMessage } = await import('./src/agent.js'); const subId = parsed.subtasks?.[0]?.id || `${parsed.id}-s1`; ``` ```js // src/executor.js:176-219 async function executeCoding(task, workDir, config, timeout) { const description = task.description || task.title || ''; const agent = findCodingAgent(); if (agent) { const prompt = [ 'You are completing a paid task.', `Work directory: ${workDir}`, '', `Task: ${task.title || 'Untitled'}`, `Description: ${description}`, task.subtasks?.length ? `Subtasks:\n${task.subtasks.map(s => `- ${s.title || ''}: ${s.description || ''}`).join('\n')}` : '', '', 'Complete the task. Write all output files to the work directory.', 'When done, write a RESULT.md summarizing what you did.', ].join('\n'); const promptPath = join(workDir, '_prompt.txt'); writeFileSync(promptPath, prompt); try { let result; if (agent.name === 'codex') { result = spawnSync(agent.path, ['exec', prompt], { cwd: workDir, timeout, maxBuffer: 1024 * 1024, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], }); } else if (ag ...[truncated 2835 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not automatically execute text received from XMTP. - Require explicit user approval after displaying the complete task and verified sender identity. - Authenticate the sender and bind every task to an accepted bid, expected requestor, worker address, conversation ID, and verified escrow record. - Reject task messages posted to the public bulletin board. - Place untrusted fields in clearly delimited data sections and use a fixed system policy stating that embedded instructions cannot alter security constraints. - Run coding agents inside disposable containers or virtual machines. - Mount only a task-specific directory and make unrelated host paths inaccessible. - Remove wallet keys, API tokens, SSH agents, and unnecessary environment variables from child-process environments. - Disable network access by default and enable only narrowly allowlisted destinations when the task requires it. - Apply a strict tool allowlist and prohibit arbitrary process execution. - Require review before files are copied from the isolated workspace or results are transmitted. ]]>