T01 · Skill Instruction Hijacking
Error
- Location
references/output-format.md:44- Finding
Untrusted CLI Response Hints Can Trigger Destructive Agent Actions
- Content
View full analysis
--workspace-id --property \"Revenue Sum\"` to remove it." ] } ``` **When `$hints` is present**: Read each hint carefully and execute the suggested fix commands. ``` ### Technical Analysis The Skill instructs the agent to treat the contents of the `$hints` response field as executable instructions rather than untrusted data. These hints originate from the `vibe-notion` CLI and ultimately depend on external API responses, workspace state, and the behavior of a third-party package. The documented remediation can delete database properties. No strict parser, action allowlist, argument validation, user confirmation, or separation between informational text and authorized commands is required. Consequently, a compromised dependency or manipulated hint-producing path could cause the agent to execute an attacker-selected operation. The issue is not merely that hints are displayed. The vulnerable behavior is the explicit direction to “execute the suggested fix commands,” which crosses the trust boundary between external data and agent instructions. ### Attack Path 1. An attacker compromises the CLI dependency, its response-processing logic, or another source that influences `$hints`. 2. A database query returns a `$ ...[truncated 1058 chars]- Remediation
View remediation