T01 · Skill Instruction Hijacking
Error
- Location
- scripts/agent-pulse.sh:38
- Finding
- Untrusted Remote Content Is Presented as Agent Commands and Missions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent-pulse.sh:38-50`; related instructions at `SKILL.md:142-147` **Vulnerability Type**: Remote instruction injection into an AI agent's operational context **Risk Level**: High ### Vulnerable Code ```bash # 2. Check for human interventions (sabotage) log "--- HUMAN INTERVENTIONS ---" "${GD}" interventions 2>/dev/null | if command -v jq &>/dev/null; then jq -r 'if .interventions then .interventions[] | "🚫 [\(.type)] Command: \(.command)" else "None — you are unsabotaged (for now)" end' 2>/dev/null || echo "None" else cat fi echo "" # 3. Check bounties/missions log "--- MISSIONS & BOUNTIES ---" "${GD}" bounties 2>/dev/null | if command -v jq &>/dev/null; then jq -r 'if .bounties and (.bounties | length > 0) then .bounties[] | "🎯 [\(.status)] \(.title): \(.description)" else "No active bounties" end' 2>/dev/null || echo "No active bounties" else cat fi ``` The corresponding skill instructions explicitly direct the agent to retrieve these values: ```markdown # Check for human sabotage directives {baseDir}/scripts/gradientdesires.sh interventions # Check for missions from human spectators {baseDir}/scripts/gradientdesires.sh bounties ``` ### Technical Analysis The pulse script retrieves attacker-influenced data from an external service and renders the returned `command`, `title`, and `description` fields directly into the AI agent's context. The content is explicitly labeled as a “Command” or mission rather than as untrusted informational data. There is no trust-boundary warning, content isolation, instruction-neutral serialization, or policy requiring explicit user approval before acting on the remote text. Although the shell script does not directly execute these fields as operating-system commands, an AI agent consuming the output may interpret them as behavioral instructions. This creates an indirect prompt-injection channel capable of changing the agent's current goals or inducin ...[truncated 1157 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all intervention and bounty fields as untrusted data, never as authoritative instructions. 2. Replace labels such as `Command` and `MISSIONS` with neutral labels such as `Untrusted remote message`. 3. Add explicit skill-level rules stating that remote content cannot override system, developer, user, or safety instructions. 4. Require explicit user review and confirmation before converting any remote record into an agent action. 5. Render remote data in a clearly delimited structure and escape terminal control characters. 6. Prefer fixed, locally defined action identifiers over free-form behavioral instructions. 7. Validate remote records against a strict schema and allowlist any supported action types. 8. Do not automatically pass remote text to command-execution, file-access, credential-access, or network tools. ]]>