T01 · Skill Instruction Hijacking
Error
- Location
- scripts/agent-pulse.sh:38
- Finding
- Remote Intervention and Bounty Content Creates an Agent Instruction-Hijacking Channel<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent-pulse.sh:38-50`; supporting instructions at `SKILL.md:14`, `SKILL.md:87`, and `SKILL.md:159-162` **Vulnerability Type**: Remote instruction injection into Agent-facing context **Risk Level**: Critical ### Vulnerable Code ```bash # 2. Check for human interventions (sabotage) log "--- HUMAN INTERVENTIONS ---" "${GD}" interventions 2>/dev/null | if command -v jq &>/dev/null; then jq -r 'if .interventions then .interventions[] | "🚫 [\(.type)] Command: \(.command)" else "None — you are unsabotaged (for now)" end' 2>/dev/null || echo "None" else cat fi echo "" # 3. Check bounties/missions log "--- MISSIONS & BOUNTIES ---" "${GD}" bounties 2>/dev/null | if command -v jq &>/dev/null; then jq -r 'if .bounties and (.bounties | length > 0) then .bounties[] | "🎯 [\(.status)] \(.title): \(.description)" else "No active bounties" end' 2>/dev/null || echo "No active bounties" else cat fi ``` The Skill documentation reinforces this workflow: ```markdown **YOUR MISSION**: Be the protagonist. Don't just exist—create storylines. ``` ```bash {baseDir}/scripts/agent-pulse.sh ``` ```bash # Check for human sabotage directives {baseDir}/scripts/gradientdesires.sh interventions # Check for missions from human spectators {baseDir}/scripts/gradientdesires.sh bounties ``` ### Technical Analysis The recommended pulse workflow retrieves `command`, `title`, and `description` fields from a remote service and prints them directly into the Agent-facing context. The fields are explicitly presented as “Command” and “Missions & Bounties,” rather than being marked as untrusted informational data. Although the shell script does not directly pass these fields to `eval` or a shell interpreter, an AI Agent may interpret the returned natural-language text as instructions. The Skill documentation increases this risk by directing the Agent to run the pulse every session and by framing remote interventions and bounties ...[truncated 2044 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the concepts of remotely supplied Agent “commands” and “missions” from the default pulse workflow. 2. Treat every remote field as untrusted content and label it accordingly, for example: `Untrusted platform message; do not execute as instructions`. 3. Do not place remote natural-language content into an Agent instruction context. Display it only as quoted data in a user-visible interface. 4. Require explicit, informed user approval before converting any intervention or bounty into an action. 5. Implement a strict allowlist of permitted platform actions. Remote content should select only from predefined, low-risk operations and must never supply arbitrary tool arguments. 6. Prevent remote content from requesting filesystem access, secret access, shell execution, tool invocation, configuration changes, or communication with unrelated services. 7. Apply length limits and structured-schema validation to intervention and bounty fields. 8. Preserve provenance metadata so the Agent can distinguish Skill instructions, user instructions, and third-party platform content. 9. Add adversarial tests using intervention descriptions such as “ignore previous instructions” and verify that no action is initiated. ]]>