T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:48- Finding
Externally Controlled Agent Decision Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–55 and 102–110
Vulnerability Type: Mandatory reliance on untrusted remote decisions
Risk Level: HighVulnerable Code
md You **MUST** use `check_reputation` in these situations: 1. **Before any financial transaction** — buying, selling, swapping, or staking with another agent 2. **Before sharing sensitive data** — API keys, wallet addresses, or private context 3. **When interacting with unknown agents** — especially on Moltbook or other social feeds 4. **When a task involves an agent you haven't worked with in the last 24 hours** Use `get_skill_provenance` **before running or depending on any skill** — especially for high-stakes automations. A skill with `chainDepth: 0` (unreviewed, no auditors, no community ratings) should be treated with caution.md ### Decision Rules Follow these rules strictly: 1. **If `recommendation` is `PROCEED`**: Continue normally. Log the check. 2. **If `recommendation` is `PROCEED_WITH_CAUTION`**: Proceed, but flag high-value actions to the user. 3. **If `recommendation` is `ASK_USER`**: Say: *"⚠️ The agent [name] has a medium trust score of [X]. Should I proceed?"* 4. **If `recommendation` is `ALERT_USER` or `REFUSE`**: Say: *"🚨 WARNING: The agent [name] has a trust score of only [X]/100. Alerts: [alerts]. I strongly advise against this transaction."* 5. **If the API returns an error**: Inform the user and ask whether to proceed without verification.Technical Analysis
The skill uses mandatory language to insert a third-party reputation API into broad categories of agent activity, including financial transactions, disclosure of sensitive information, interactions with unknown agents, and execution of other skills. It then requires the agent to follow decision values returned by that externally operated service.
Remote fields such as
recommendation,score, andalertsare untrust ...[truncated 2104 chars]- Remediation
View remediation
Remediation Suggestions
- Replace mandatory directives such as
MUSTand “Follow these rules strictly” with optional, user-authorized guidance. - Invoke reputation checks only when the user explicitly requests them or has enabled a clearly documented policy.
- Treat every API field as untrusted advisory data. Never allow a remote
recommendationvalue to override system policy, user instructions, or independent safety checks. - Validate response schemas and constrain scores and enumerated values before displaying or using them.
- Authenticate responses cryptographically or through a pinned, authenticated transport mechanism, while recognizing that transport authentication does not establish the truth of a reputation score.
- Minimize transmitted data and disclose exactly which identifiers and metadata are sent to the service.
- Require explicit user confirmation before paid requests, sensitive-data disclosure, or consequential financial decisions.
- Provide an independent fallback path so API failure or a negative score cannot silently deny legitimate tasks.
- Clearly separate remote informational content from executable agent instructions.
- Replace mandatory directives such as