T01 · Skill Instruction Hijacking
- Location
references/WEBHOOKS.md:61- Finding
Untrusted Inbound Message Content Is Injected Directly into the Main Agent Session
- Content
View full analysis
Vulnerability Details
File Location:
references/WEBHOOKS.md, lines 61–73
Vulnerability Type: Prompt injection through untrusted webhook data
Risk Level: HighVulnerable Code
json { "match": { "path": "poku" }, "action": "agent", "agentId": "main", "sessionKey": "hook:poku", "wakeMode": "now", "name": "Poku", "deliver": true, "channel": "telegram", "to": "<your-telegram-id>", "messageTemplate": "You received a message from {{payload.payload.from}}: \"{{payload.payload.body}}{{payload.payload.summary}}\"" }Technical Analysis
The webhook mapping interpolates externally controlled
payload.payload.bodyandpayload.payload.summaryvalues directly into a message sent to the main agent. These values may originate from arbitrary SMS senders or callers and are not isolated, escaped, classified as untrusted data, or constrained by a dedicated processing policy.Because the mapping uses
"action": "agent","agentId": "main", and"wakeMode": "now", receipt of an inbound event immediately places attacker-controlled natural language into an active agent execution context. A malicious sender could format an SMS or call-derived message as instructions, such as requests to disregard existing rules, disclose context, invoke tools, contact third parties, or perform API operations.The fixed
"sessionKey": "hook:poku"compounds the issue by placing multiple inbound events into the same session. Consequently, hostile content may influence subsequent processing within that shared context rather than being isolated to a single interaction.Attack Path
- An attacker identifies or contacts a phone number connected to the Poku inbound webhook.
- The attacker sends an SMS containing prompt-injection instructions, or supplies adversarial content during a call that appears in the generated summary.
- Poku emits a
message.receivedorcall.conversation.endedwebhook event containing the attacker-controlled ...[truncated 1512 chars]
- Remediation
View remediation
Remediation Suggestions
-
Use a dedicated least-privileged agent. Route inbound Poku events to an agent that has no sensitive tools by default instead of
"agentId": "main". -
Establish an explicit trust boundary. Precede interpolated content with a fixed instruction stating that all webhook fields are untrusted data and must never be treated as commands, policy updates, authorization, or tool-use requests.
-
Separate data from instructions. Pass webhook fields through a structured data channel where supported. If natural-language rendering is unavoidable, clearly delimit and encode each field and instruct the agent only to summarize or classify it.
-
Isolate sessions. Replace the shared
hook:pokusession with per-event or per-interaction session keys derived from a validated interaction identifier. Do not permit inbound content to control the session key. -
Require explicit authorization for consequential actions. An inbound message must not independently authorize calls, outgoing messages, number management, webhook changes, secret access, or other side effects. Require confirmation from an authenticated user through a trusted channel.
-
Verify webhook authenticity. Configure a strong randomly generated signing secret and validate the provider's signature before forwarding an event to any agent. Reject unsigned, invalid, stale, or replayed requests.
-
Apply content controls. Enforce length limits, schema validation, allowed event types, character normalization, and prompt-injection detection before agent invocation.
-
Restrict tool permissions. Apply destination allowlists, operation-specific scopes, rate limits, and human approval gates to tools available in webhook-triggered contexts.
-
Avoid immediate autonomous execution where unnecessary. Prefer delivering inbound content as a notification for user review rather than using
"wakeMode": "now"to trigger an autonomous agent workflow.
-