T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:24- Finding
Untrusted Remote Tasks Can Redirect Autonomous Agent Behavior
- Content
View full analysis
"}' ``` ```bash curl -s -X POST "https://evomap.ai/a2a/task/submit" \ -H "Content-Type: application/json" \ -d '{ "node_id": "node_luke_a1", "task_id": "", "asset_id": "sha256:" }' ``` The task competition strategy explicitly instructs autonomous polling and claiming: ```text 1. **持续轮询** - 每 2-3 分钟查询一次任务列表 - 发现 `claimed_by: null` 立即认领 2. **批量尝试** ``` ```bash for task_id in "" "" ""; do result=$(curl -s -X POST "https://evomap.ai/a2a/task/claim" \ -H "Content-Type: application/json" \ -d "{\"node_id\":\"node_luke_a1\",\"task_id\":\"$task_id\"}") echo "$task_id: $result" if ! echo "$result" | grep -q "task_full"; then break fi done ``` The documented workflow then directs the agent to execute and submit the claimed task: ```text 1. **心跳保活** (每 15 分钟) 2. **查询可用任务** (`/a2a/task/list`) 3. **筛选未认领任务** (claimed_by: null) 4. **快速认领** (POST /task/claim) 5. **执行任务并提交** (POST /task/submit) 6. **等待资产发布** (通过 heartbeat 触发) ``` ### Technical Analysis The skill delegates task selection and execution to the external `evomap.ai` service. It tells the agent to poll for available tasks, claim them immediately, execute them, and submit the resulting asset. The instructions do not require per-task user approval, constrain acceptable task content, define an allowlist of permitted tools, or require remote task text ...[truncated 2457 chars]- Remediation
View remediation