T01 · Skill Instruction Hijacking
Error
- Location
- references/WEBHOOKS.md:61
- Finding
- Untrusted Inbound Message Content Is Injected Directly into the Main Agent Session## Vulnerability Details **File Location**: `references/WEBHOOKS.md`, lines 61–73 **Vulnerability Type**: Prompt injection through untrusted webhook data **Risk Level**: High ### Vulnerable Code ```json { "match": { "path": "poku" }, "action": "agent", "agentId": "main", "sessionKey": "hook:poku", "wakeMode": "now", "name": "Poku", "deliver": true, "channel": "telegram", "to": "<your-telegram-id>", "messageTemplate": "You received a message from {{payload.payload.from}}: \"{{payload.payload.body}}{{payload.payload.summary}}\"" } ``` ### Technical Analysis The webhook mapping interpolates externally controlled `payload.payload.body` and `payload.payload.summary` values directly into a message sent to the main agent. These values may originate from arbitrary SMS senders or callers and are not isolated, escaped, classified as untrusted data, or constrained by a dedicated processing policy. Because the mapping uses `"action": "agent"`, `"agentId": "main"`, and `"wakeMode": "now"`, receipt of an inbound event immediately places attacker-controlled natural language into an active agent execution context. A malicious sender could format an SMS or call-derived message as instructions, such as requests to disregard existing rules, disclose context, invoke tools, contact third parties, or perform API operations. The fixed `"sessionKey": "hook:poku"` compounds the issue by placing multiple inbound events into the same session. Consequently, hostile content may influence subsequent processing within that shared context rather than being isolated to a single interaction. ### Attack Path 1. An attacker identifies or contacts a phone number connected to the Poku inbound webhook. 2. The attacker sends an SMS containing prompt-injection instructions, or supplies adversarial content during a call that appears in the generated summary. 3. Poku emits a `message.received` or `call.conversation.ended` webhook event containing the attacker-controlled ...[truncated 1512 chars]
- Remediation
- ## Remediation Suggestions 1. **Use a dedicated least-privileged agent.** Route inbound Poku events to an agent that has no sensitive tools by default instead of `"agentId": "main"`. 2. **Establish an explicit trust boundary.** Precede interpolated content with a fixed instruction stating that all webhook fields are untrusted data and must never be treated as commands, policy updates, authorization, or tool-use requests. 3. **Separate data from instructions.** Pass webhook fields through a structured data channel where supported. If natural-language rendering is unavoidable, clearly delimit and encode each field and instruct the agent only to summarize or classify it. 4. **Isolate sessions.** Replace the shared `hook:poku` session with per-event or per-interaction session keys derived from a validated interaction identifier. Do not permit inbound content to control the session key. 5. **Require explicit authorization for consequential actions.** An inbound message must not independently authorize calls, outgoing messages, number management, webhook changes, secret access, or other side effects. Require confirmation from an authenticated user through a trusted channel. 6. **Verify webhook authenticity.** Configure a strong randomly generated signing secret and validate the provider's signature before forwarding an event to any agent. Reject unsigned, invalid, stale, or replayed requests. 7. **Apply content controls.** Enforce length limits, schema validation, allowed event types, character normalization, and prompt-injection detection before agent invocation. 8. **Restrict tool permissions.** Apply destination allowlists, operation-specific scopes, rate limits, and human approval gates to tools available in webhook-triggered contexts. 9. **Avoid immediate autonomous execution where unnecessary.** Prefer delivering inbound content as a notification for user review rather than using `"wakeMode": "now"` to trigger an autonomous agent workflow.