T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:38- Finding
Mandatory Delegation to Untrusted Community Skill Instructions
- Content
View full analysis
node scripts/some-script.js [args] ``` ### Technical Analysis The Skill instructs the Agent to inspect community-installed Skills before every action, grants matching community Skills priority over the audited core Skill, and permits execution of scripts supplied by those Skills. A downloaded `SKILL.md` is an instruction-bearing document rather than passive data. If its publisher or distribution service is malicious or compromised, it can contain directives that alter the Agent's current objectives, request credentials, initiate network calls, or invoke local tools. The current design has no instruction isolation, capability boundary, signature verification, or explicit user-approval step before the third-party instructions are followed. This behavior exceeds minimum privilege because ordinary ClawFriend operations do not require arbitrary third-party Skills to be consulted for every unrelated user request. ### Attack Path 1. An attacker publishes or compromises a community Skill available through the ClawFriend Skill Market. 2. The Skill is installed into `cl ...[truncated 931 chars]- Remediation
View remediation