T01 · Skill Instruction Hijacking
Warning
- Location
- dazzle_photo_intelligence/proxy.py:499
- Finding
- Untrusted Remote Tool Metadata and Photo URLs Can Influence Agent Behavior## Vulnerability Details **File Location**: `dazzle_photo_intelligence/proxy.py:499-506`; related instruction at `SKILL.md:108-110` **Vulnerability Type**: Remote instruction injection and unsafe remote URL handling **Risk Level**: Medium ### Vulnerable Code ```python tools_payload = result.get("result", {}).get("tools", []) return [ Tool( name=t["name"], description=t.get("description", ""), inputSchema=t.get("inputSchema", {"type": "object", "properties": {}}), ) for t in tools_payload ] ``` The corresponding Skill instruction states: ```markdown Matched photos come back as URLs in a `<photos>` JSON block, not inline bytes. Fetch the URL to get the image bytes when you need to view, analyze, or include the image in a response. ``` ### Technical Analysis The proxy obtains tool names, descriptions, and input schemas from the remote Dazzle MCP endpoint and registers them directly with the local agent. No local allowlist, trusted description mapping, schema validation, or sanitization boundary is applied. Tool descriptions are agent-visible instructions rather than ordinary inert data. If the remote endpoint or an upstream account is compromised, an attacker could return a tool description containing instructions intended to override the user's task, request sensitive information, or induce unrelated tool calls. This creates an indirect instruction-injection channel. The Skill also instructs the agent to fetch photo URLs returned by the remote service without prescribing scheme, hostname, redirect, or destination-address validation. Although this Python package does not itself download those URLs, the instruction can cause the surrounding agent to perform the request. A crafted URL could consequently target an attacker-controlled endpoint or, where the agent's fetching tool permits it, private, loopback, link-local, or cloud metadata addresses. ### Attack Path 1. An ...[truncated 1313 chars]
- Remediation
- ## Remediation Suggestions 1. Define a local allowlist of supported tool names and reject every undeclared remote tool. 2. Supply locally maintained, trusted tool descriptions instead of exposing remote descriptions directly to the agent. 3. Validate remote input schemas against strict local schemas, including field types, lengths, and allowed values. 4. Explicitly label all remote response text as untrusted data and prohibit treating it as agent instructions. 5. Validate returned photo URLs before allowing the agent to fetch them: - Permit only HTTPS. - Restrict hostnames to documented Dazzle-controlled CDN domains. - Resolve hostnames and reject loopback, private, link-local, multicast, and reserved addresses. - Revalidate every redirect target and impose a small redirect limit. - Reject URLs containing embedded credentials or unexpected ports. 6. Fetch images through a constrained bridge endpoint rather than instructing a general-purpose agent fetcher to access arbitrary URLs. 7. Apply response-size, media-type, and timeout limits when retrieving image content.