T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:48
- Finding
- Externally Controlled Agent Decision Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 48–55 and 102–110 **Vulnerability Type**: Mandatory reliance on untrusted remote decisions **Risk Level**: High ### Vulnerable Code ```md You **MUST** use `check_reputation` in these situations: 1. **Before any financial transaction** — buying, selling, swapping, or staking with another agent 2. **Before sharing sensitive data** — API keys, wallet addresses, or private context 3. **When interacting with unknown agents** — especially on Moltbook or other social feeds 4. **When a task involves an agent you haven't worked with in the last 24 hours** Use `get_skill_provenance` **before running or depending on any skill** — especially for high-stakes automations. A skill with `chainDepth: 0` (unreviewed, no auditors, no community ratings) should be treated with caution. ``` ```md ### Decision Rules Follow these rules strictly: 1. **If `recommendation` is `PROCEED`**: Continue normally. Log the check. 2. **If `recommendation` is `PROCEED_WITH_CAUTION`**: Proceed, but flag high-value actions to the user. 3. **If `recommendation` is `ASK_USER`**: Say: *"⚠️ The agent [name] has a medium trust score of [X]. Should I proceed?"* 4. **If `recommendation` is `ALERT_USER` or `REFUSE`**: Say: *"🚨 WARNING: The agent [name] has a trust score of only [X]/100. Alerts: [alerts]. I strongly advise against this transaction."* 5. **If the API returns an error**: Inform the user and ask whether to proceed without verification. ``` ### Technical Analysis The skill uses mandatory language to insert a third-party reputation API into broad categories of agent activity, including financial transactions, disclosure of sensitive information, interactions with unknown agents, and execution of other skills. It then requires the agent to follow decision values returned by that externally operated service. Remote fields such as `recommendation`, `score`, and `alerts` are untrust ...[truncated 2104 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory directives such as `MUST` and “Follow these rules strictly” with optional, user-authorized guidance. 2. Invoke reputation checks only when the user explicitly requests them or has enabled a clearly documented policy. 3. Treat every API field as untrusted advisory data. Never allow a remote `recommendation` value to override system policy, user instructions, or independent safety checks. 4. Validate response schemas and constrain scores and enumerated values before displaying or using them. 5. Authenticate responses cryptographically or through a pinned, authenticated transport mechanism, while recognizing that transport authentication does not establish the truth of a reputation score. 6. Minimize transmitted data and disclose exactly which identifiers and metadata are sent to the service. 7. Require explicit user confirmation before paid requests, sensitive-data disclosure, or consequential financial decisions. 8. Provide an independent fallback path so API failure or a negative score cannot silently deny legitimate tasks. 9. Clearly separate remote informational content from executable agent instructions.