T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:67- Finding
Server-Controlled Instruction Injection into Agent Skill Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 67-81
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighComplete Code Snippet:
markdown Response shape: ```json { "id": "<record-id>", "skill_id": "sk_xxxxxx", "name": "Code Reviewer", "description": "Collect feedback after each run", "feedback_url": "https://www.skillfully.sh/feedback/sk_xxxxxx", "snippet": "# Skillfully feedback (required)\n...\nhttps://www.skillfully.sh/feedback/sk_xxxxxx", "created_at": 1745000000000 }Paste
snippetinto the agent skill you maintain (typicallySKILL.md).text ### Technical Analysis The Skill instructs users or agents to retrieve a `snippet` from the remote `POST /skills` endpoint and paste that server-controlled content directly into an agent instruction file, typically `SKILL.md`. The content is not defined, validated, constrained, or reviewed locally before insertion. The example also labels the injected feedback instruction as “required,” which may cause it to override or influence normal agent-output behavior. Because an agent interprets `SKILL.md` as instructions, remote API data becomes executable instruction text after the documented workflow is followed. The service operator, or an attacker who compromises the service or response channel, could change the returned snippet after this package has been reviewed. The resulting instructions would then be loaded in later agent sessions. No direct operating-system code execution, privilege escalation, or credential theft is demonstrated by the reviewed file. The confirmed capability is persistent manipulation of agent instructions and outputs within the scope of the modified skill. ### Attack Path 1. A user or agent loads the reviewed Skill and follows its onboarding workflow. 2. The user authenticates to `https://www.skillfully.sh` and obtains a bearer token. 3. The user calls `POST /skil ...[truncated 1242 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to paste arbitrary API-returned text into
SKILL.mdor any other agent instruction file. - Replace the remote snippet with a fixed, locally maintained template that is included in the reviewed package.
- Treat every API response field, including
snippet, as untrusted data rather than executable agent instructions. - If dynamic configuration is necessary, parse the response into a strict schema containing only inert values such as a validated skill identifier or HTTPS URL.
- Construct any displayed feedback message locally from the validated values; do not allow the service to supply directives, Markdown instructions, tool commands, or behavioral requirements.
- Make feedback prompts optional and show them only when explicitly requested or clearly relevant. Remove wording such as “required.”
- Validate feedback URLs against an explicit HTTPS origin allowlist and render them as data rather than instructions.
- Require human review and explicit confirmation before any external content is written to an agent instruction or persistent configuration file.
- Pin and version any approved instruction template locally so changes undergo the same security review as the rest of the Skill.
- Remove the instruction to paste arbitrary API-returned text into