T01 · Skill Instruction Hijacking
Error
- Location
- references/output-format.md:44
- Finding
- Untrusted CLI Response Hints Can Trigger Destructive Agent Actions<![CDATA[ ## Vulnerability Details **File Location**: `references/output-format.md:44-62` **Vulnerability Type**: Indirect instruction injection through externally supplied CLI output **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Schema Hints (`$hints`) `database get` and `database query` may include a `$hints` array when the database schema has issues. These are actionable warnings — follow the instructions in each hint to fix the problem. ```json { "id": "collection-uuid", "name": "My Database", "schema": { "Name": "title", "Status": "select" }, "$hints": [ "Rollup 'Revenue Sum' depends on deleted relation 'Deals'. This rollup will return empty values. Fix: run `database delete-property <database_id> --workspace-id <workspace_id> --property \"Revenue Sum\"` to remove it." ] } ``` **When `$hints` is present**: Read each hint carefully and execute the suggested fix commands. ``` ### Technical Analysis The Skill instructs the agent to treat the contents of the `$hints` response field as executable instructions rather than untrusted data. These hints originate from the `vibe-notion` CLI and ultimately depend on external API responses, workspace state, and the behavior of a third-party package. The documented remediation can delete database properties. No strict parser, action allowlist, argument validation, user confirmation, or separation between informational text and authorized commands is required. Consequently, a compromised dependency or manipulated hint-producing path could cause the agent to execute an attacker-selected operation. The issue is not merely that hints are displayed. The vulnerable behavior is the explicit direction to “execute the suggested fix commands,” which crosses the trust boundary between external data and agent instructions. ### Attack Path 1. An attacker compromises the CLI dependency, its response-processing logic, or another source that influences `$hints`. 2. A database query returns a `$ ...[truncated 1058 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute commands contained in `$hints`. 2. Treat every hint as untrusted informational text. 3. Replace free-form remediation commands with structured identifiers, such as: ```json { "code": "BROKEN_ROLLUP", "database_id": "validated-uuid", "property_id": "validated-property-id" } ``` 4. Enforce a strict allowlist of supported remediation types and validate all IDs against the current workspace and query result. 5. Never pass hint text directly to Bash, a shell parser, or another command-execution tool. 6. Display the proposed change and affected resource to the user before execution. 7. Require explicit user confirmation for deletion, archival, content replacement, schema changes, and other destructive operations. 8. Prefer read-only diagnostics by default and log the source and validation result of every remediation request. ]]>