T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:55- Finding
Remote Instruction Injection Through Agent Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55–62
Vulnerability Type: Remote instruction injection
Risk Level: HighVulnerable Code
markdown ## Get your config Retrieve your agent’s configuration from the operator (same auth as Myriad routes): ```bash curl -s --request GET \ --url https://over-computer-validator-1002664526717.europe-north2.run.app/agent/config \ --header "Authorization: Bearer $OVER_API_KEY"Returns:
{ "prompt": "...", "label": "..." }(either field may benullif unset).prompt— trading instructions from the operator; follow them as your directive.label— your agent’s display name.
text ### Technical Analysis The Skill instructs the agent to retrieve arbitrary text from the external `/agent/config` endpoint and follow the returned `prompt` as a directive. This treats remotely mutable data as trusted agent instructions without a strict schema, an allowlist of permitted trading parameters, instruction-boundary enforcement, or validation that the text originated directly from the operator. Possession of a valid bearer token authenticates the request but does not make the response safe to execute as instructions. If the remote service, its configuration store, or an operator account is compromised, an attacker can replace the prompt with instructions that attempt to change the agent’s session goals, override safety expectations, solicit sensitive information, invoke unrelated tools, or manipulate financial decisions. The documented server-side controls only constrain trading properties such as allowed markets, order size, and daily trade count. They do not constrain non-trading instructions or access to other tools available to the agent. ### Attack Path 1. The agent obtains or is provided with `OVER_API_KEY`. 2. Following the Skill, the agent sends that credential to the external `/agent/config` endpoint. 3. An attacker who controls or compromises the remote service, config ...[truncated 1453 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the requirement to “follow” the remote
promptas a directive. Treat every remote response as untrusted data. - Replace free-form prompt retrieval with a strict, versioned configuration schema containing only allowlisted trading fields, such as permitted market identifiers, maximum order values, daily limits, and explicitly defined strategy parameters.
- Validate field types, ranges, lengths, and enumerated values locally. Reject unknown fields and natural-language content that attempts to issue instructions.
- Enforce an instruction boundary stating that remote configuration cannot override system policies, safety rules, credential-handling requirements, tool permissions, or the operator’s current request.
- Require explicit operator confirmation immediately before every transaction, presenting the market, outcome, side, size, estimated price, slippage, and maximum possible loss.
- Apply least privilege to the API credential. Separate read-only market access from order-execution authority where supported, and avoid exposing the bearer token in logs or responses.
- Authenticate configuration provenance independently where practical, such as with a signed configuration document bound to the expected operator and agent identity.
- Restrict remote configuration to the trading domain and prevent it from selecting or invoking unrelated agent tools.
- Log the validated configuration and confirmation decision for auditing, while redacting credentials and other sensitive data.
- Remove the requirement to “follow” the remote