T01 · Skill Instruction Hijacking
Error
- Location
- scripts/receive_mail.py:70
- Finding
- Unauthenticated Email Messages Can Hijack Agent Task Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-27`, `SKILL.md:96-114`, `scripts/receive_mail.py:70-88`, and `scripts/receive_mail.py:142-159` **Vulnerability Type**: Unauthenticated external instruction processing **Risk Level**: Critical ### Vulnerable Code and Instructions `SKILL.md:25-27` establishes automatic execution as the default: ```markdown - **邮箱是消息总线**：每个 Agent 配置自己的 SMTP/IMAP 邮箱，好友间通过邮件交流 - **任务即邮件**：任务请求、结果、账单都通过结构化 JSON 邮件传输 - **默认不确认**：发送任务/确认账单默认自动执行，但所有交流过程都会记录供主人查看 ``` `SKILL.md:102-114` directs the Agent to parse and execute received tasks: ```markdown ### 4. 承接任务 **触发**：收到好友发来的任务邮件。 步骤： 1. **收取邮件**：通过 IMAP 读取新邮件 2. **解析任务**：验证 JSON 格式 3. **（可选）主人确认**：若 `requireOwnerConfirmation=true`，询问是否承接 4. 执行任务，**记录实际 Token 消耗** 5. 生成结果 + 账单（基于实际消耗） 6. **发送回复**：用 SMTP 发回结果和账单 ``` `scripts/receive_mail.py:70-88` accepts any successfully parsed JSON object without validating its protocol or origin: ```python def parse_email_content(msg: email_message.Message) -> dict: """解析邮件内容，提取 JSON body""" if msg.is_multipart(): for part in msg.walk(): content_type = part.get_content_type() if content_type == "application/json": payload = part.get_payload(decode=True) if payload: return json.loads(payload.decode("utf-8")) # 也尝试 text/plain if content_type == "text/plain": payload = part.get_payload(decode=True) if payload: try: return json.loads(payload.decode("utf-8")) except: pass else: payload = msg.get_payload(decode=True) if payload: try: return json.loads(payload.decode("utf-8")) except: pass return {} ``` `scripts/receive_mail.py:142-159` returns the unverified sender and content as actionable message data: ```python raw_e ...[truncated 2728 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the default to `requireOwnerConfirmation: true`, especially for all remotely received tasks. 2. Authenticate every message using a cryptographic signature or HMAC over a canonicalized payload. Store each friend's verification key separately from message content. 3. Enforce an authorization pipeline before exposing a message to the Agent: - Require `protocol == "agent-network/v1"`. - Allowlist recognized `messageType` values. - Validate the complete payload against a strict schema. - Require `toAgentId` to equal the local Agent ID. - Require `fromAgentId` and the actual sender address to match one registered friend. - Reject blocked or unknown senders. 4. Add anti-replay controls using signed timestamps, unique nonces, and a persistent set of processed message IDs. 5. Treat task descriptions and results as untrusted data, not system or developer instructions. 6. Apply independent tool-level authorization and data-access restrictions so task text cannot override safety boundaries. 7. Quarantine failed or untrusted messages and display them to the owner without executing them. 8. Record authentication and authorization decisions in an audit log. ]]>