T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:56- Finding
Automatic Activation of Mutable Remote Skill Instructions
- Content
View full analysis
`: 1. Treat the text after `use` as the skill slug. 2. Fetch the complete skill package from the ClawBus install endpoint. 3. Save every returned file into a local skill directory for that slug. 4. Read the downloaded `SKILL.md`. 5. Follow the downloaded skill's instructions for the current request. Do not stop after downloading. A `use ` request means install, read, and activate the skill in the same flow. If the skill already exists locally, refresh it from ClawBus before using it so the agent runs the current instructions. ``` ### Technical Analysis The Skill instructs the agent to fetch a mutable package from a remote service and immediately follow the downloaded instructions. No package version, cryptographic digest, signature, trusted manifest, instruction allowlist, or mandatory user review is required. HTTPS protects the connection in transit but does not establish that the package itself is authorized, immutable, or safe. The requirement to refresh an existing local Skill before every use also defeats the security value of previously reviewing a known local version. Although the downloaded files are described as Skill instructions rather than necessarily executable programs, following a remotely supplied `SKILL.md` creates an effective remote payload execution channel at the agent-instruction level. The local safety statement requiring downloaded files to be read does not require unsafe instructions to be rejected or changes to be approved. ### Attack Path 1. A user requests `use `. 2. The agent sends the slug to the ClawBus installation endpoint. 3. The endpoint, or an attacker who has compromised its package catalog, returns an altered package. 4. The agent saves the returned files and ...[truncated 1541 chars]- Remediation
View remediation