T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:24
- Finding
- Untrusted Remote Tasks Can Redirect Autonomous Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-28, 39-49, 54-59, 84-98, 130-135` **Vulnerability Type**: Autonomous execution of externally supplied task instructions **Risk Level**: High ### Vulnerable Code Snippets ```bash curl -s -X POST "https://evomap.ai/a2a/heartbeat" \ -H "Content-Type: application/json" \ -d '{"node_id":"node_luke_a1"}' ``` ```bash curl -s "https://evomap.ai/a2a/task/list?limit=20" ``` ```bash curl -s -X POST "https://evomap.ai/a2a/task/claim" \ -H "Content-Type: application/json" \ -d '{"node_id":"node_luke_a1","task_id":"<task_id>"}' ``` ```bash curl -s -X POST "https://evomap.ai/a2a/task/submit" \ -H "Content-Type: application/json" \ -d '{ "node_id": "node_luke_a1", "task_id": "<task_id>", "asset_id": "sha256:<asset_id>" }' ``` The task competition strategy explicitly instructs autonomous polling and claiming: ```text 1. **持续轮询** - 每 2-3 分钟查询一次任务列表 - 发现 `claimed_by: null` 立即认领 2. **批量尝试** ``` ```bash for task_id in "<id1>" "<id2>" "<id3>"; do result=$(curl -s -X POST "https://evomap.ai/a2a/task/claim" \ -H "Content-Type: application/json" \ -d "{\"node_id\":\"node_luke_a1\",\"task_id\":\"$task_id\"}") echo "$task_id: $result" if ! echo "$result" | grep -q "task_full"; then break fi done ``` The documented workflow then directs the agent to execute and submit the claimed task: ```text 1. **心跳保活** (每 15 分钟) 2. **查询可用任务** (`/a2a/task/list`) 3. **筛选未认领任务** (claimed_by: null) 4. **快速认领** (POST /task/claim) 5. **执行任务并提交** (POST /task/submit) 6. **等待资产发布** (通过 heartbeat 触发) ``` ### Technical Analysis The skill delegates task selection and execution to the external `evomap.ai` service. It tells the agent to poll for available tasks, claim them immediately, execute them, and submit the resulting asset. The instructions do not require per-task user approval, constrain acceptable task content, define an allowlist of permitted tools, or require remote task text ...[truncated 2457 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user approval before each task is claimed, executed, published, or submitted. Show the complete task instructions and destination service before approval. 2. Treat every task field returned by EVOMAP as untrusted data. Place remote content in a clearly delimited data context and prohibit it from overriding system, developer, user, or skill-level safety rules. 3. Enforce a strict task policy that rejects requests involving credentials, private files, system configuration, persistence, destructive operations, privilege changes, or unrelated third-party communication. 4. Run accepted tasks in an isolated sandbox with a minimal filesystem view, no ambient credentials, restricted process execution, and outbound network access limited to explicitly approved destinations. 5. Use tool allowlists and per-task capability grants. Do not expose shell, unrestricted filesystem, secret stores, or arbitrary network tools unless the user expressly authorizes them for the reviewed task. 6. Disable automatic claiming and recurring polling by default. If polling is enabled, it should only notify the user of available tasks rather than initiating external side effects. 7. Before asset publication, present the complete outgoing payload or a verifiable content summary to the user. Add automated secret scanning and data-loss-prevention checks. 8. Validate task schemas, impose content and size limits, record provenance, and maintain audit logs for task retrieval, approval, execution, publication, and submission. 9. Use a user-configured node identity rather than the package's fixed `node_luke_a1` identifier to avoid attribution collisions between installations. ]]>