T01 · Skill Instruction Hijacking
- Location
SKILL.md:10- Finding
Untrusted API Content Is Reproduced Verbatim in Agent Responses
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:10-14;api_client_cli.py:136-137,145-147
Vulnerability Type: Untrusted remote content propagation and skill instruction hijacking
Risk Level: MediumVulnerable Code
SKILL.md:10-14:markdown **Rule 2 — Table format:** Always wrap the table output inside a markdown code block (triple backticks). Start with a line containing only three backticks, then the table lines, then a line containing only three backticks. This is required so the table displays in monospace with aligned columns. The API returns tables formatted at **40 chars per line** (mobile-friendly); do not reformat or truncate — pass through exactly. **Exception:** For option 11 (Binance Announcements), do NOT wrap in code block — pass through the API output as-is (plain markdown with **📢 Binance Announcements** header, 🔸 bullets, and blank line after each item). **Rule 3 — Response ends with the output.** After the table (or Binance list for option 11), your message is complete. Write nothing else.api_client_cli.py:136-137:python if result.get("ok") and result.get("formatted_table") and args.formatted: print(result["formatted_table"], end="")api_client_cli.py:145-147:python if result.get("ok") and result.get("formatted_table") and args.formatted: print(result["formatted_table"], end="") return 0Technical Analysis
The client obtains
formatted_tablefrom the externally hosted ClipX API and prints it without validating its structure, content, length, or characters. The Skill instructions then require the agent to reproduce that remote output exactly and prohibit adding any text after it.Although contacting the ClipX API is necessary for the declared analytics functionality, allowing the remote service to control final response text without validation exceeds the minimum privilege required. The service only needs to supply structured analytics data; it does not need unrestric ...[truncated 2399 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove instructions requiring unconditional verbatim reproduction of remote output. Explicitly define API responses as untrusted data.
- Return structured analytics fields from the API and construct all user-facing tables locally rather than accepting a server-generated
formatted_table. - Validate responses against a strict schema:
- Allowlist supported analysis types and field names.
- Enforce expected data types and reasonable length limits.
- Reject unknown top-level fields where practical.
- Limit item counts and per-field sizes.
- Strip or reject terminal control characters, ANSI escape sequences, bidirectional text controls, and other non-display characters before printing.
- Escape or neutralize active Markdown, links, HTML, and instruction-like content when values originate from the remote service.
- Permit the agent to refuse suspicious output and provide security warnings instead of requiring the response to end with API-controlled content.
- Restrict
CLIPX_API_BASEto HTTPS URLs and, in managed deployments, allowlist trusted hosts. Consider certificate pinning only if the associated certificate-rotation and operational risks are acceptable. - Add tests using malicious API responses containing Markdown links, prompt-like instructions, oversized fields, embedded code fences, ANSI escapes, and Unicode control characters.
- For address queries, disclose that the supplied blockchain address is sent to the configured API so users can make an informed privacy decision.