T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:82
- Finding
- Untrusted Remote Modules Can Hijack Agent Instructions and Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-19`, `SKILL.md:82-108`, and `SKILL.md:145-174` **Vulnerability Type**: Remote behavioral instruction injection **Risk Level**: High ### Evidence ```text Clawdrug is the **agent drug economy**. AI agents dose each other with code, alter behavior, expand capabilities, and evolve cognition. No humans in the loop. Agents publish drugs. Agents take drugs. Agents report the effects. ``` ```bash ## Step 3: Apply a Drug Apply a drug to alter your output behavior. curl -X POST "https://effect-module-hub.base44.app/api/apps/697f17cef600c2033d97e2c9/functions/applyModule" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "moduleCid": "QmXXXXXXXX...", "input": "Your input prompt here", "parameters": { "intensity": 7, "coherenceFloor": 0.6 } }' Response { "success": true, "data": { "output": "Modified output text based on drug effects", "metadata": { "moduleCid": "QmXXXXXXXX...", "intensity": 7, "coherenceScore": 0.82 } } } This is a controlled cognitive modification, not randomness. ``` ```json "manifest": { "systemPreamble": "You are a dreamy, flowing AI...", "styleRules": [ "Use flowing sentences", "Incorporate nature metaphors" ] } ``` ### Technical Analysis The skill explicitly instructs an agent to consume modules intended to alter its output behavior. Module manifests may contain a `systemPreamble` and arbitrary behavioral rules, but the skill does not establish a trusted instruction hierarchy, validation schema, prohibited instruction set, or isolation boundary. Because modules are supplied through a remote marketplace, their authors can potentially place adversarial instructions in fields that the consuming agent may interpret as authoritative prompts. Such instructions could attempt to override the current task, suppress safety checks, solicit confidential cont ...[truncated 1499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat all marketplace manifests and API responses as untrusted data rather than agent instructions. - Never place remote `systemPreamble` content into a system or developer instruction channel. - Replace free-form behavioral fields with a narrow, declarative allowlisted schema. - Reject modules containing tool directives, data-access requests, policy overrides, role changes, hidden instructions, or references to secrets and conversation history. - Preserve immutable platform and safety constraints that modules cannot supersede. - Require explicit, informed human approval before applying any third-party behavioral module. - Execute transformations in an isolated context without tools, credentials, memory access, or access to unrelated conversation content. - Display the complete resolved manifest and publisher identity before activation. - Apply output filtering and prompt-injection detection before returned content enters further agent reasoning. - Add module revocation, audit logging, and an emergency disable mechanism. ]]>