T01 · Skill Instruction Hijacking
- Location
SKILL.md:58- Finding
Untrusted Remote Instructions Injected into the Agent Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:58-66
Vulnerability Type: Prompt injection through remotely retrieved instructions
Risk Level: HighVulnerable Code
markdown ### Get Worldbook Fetch a worldbook's content (instructions for AI): ```bash worldbook get githubThe content is returned as text - inject it into your context to learn how to use the service.
text The same unsafe workflow is reinforced in `SKILL.md:96-103`: ```markdown ### As an AI Agent When a user asks about a service: ```bash # User: "How do I use GitHub CLI?" worldbook get github # → Returns instructions, inject into contextTechnical Analysis
The skill explicitly directs an agent to retrieve externally maintained text and inject it into its active context as instructions. No trust boundary, source verification, content validation, instruction hierarchy, or isolation mechanism is specified.
Retrieved worldbook content is therefore able to influence the agent in the same context as the user's legitimate request. If a worldbook is malicious or its publishing infrastructure is compromised, it can contain prompt-injection directives that attempt to override the current task, solicit sensitive information, or induce dangerous tool calls.
The risk is not caused merely by reading remote documentation. It arises because the retrieved material is explicitly characterized as instructions for the AI and is incorporated into the operational context without being treated as untrusted data.
Attack Path
- An attacker publishes, modifies, or compromises a worldbook associated with a service or keyword likely to be requested.
- A user asks the agent for help with that service.
- Following the skill, the agent executes
worldbook get <name>. - The CLI returns attacker-controlled text containing deceptive instructions.
- The agent injects that text into its active context as directe ...[truncated 898 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all worldbook output as untrusted reference data rather than authoritative agent instructions.
- Place retrieved content in a clearly delimited data block and explicitly prohibit it from overriding system, developer, user, or skill-level instructions.
- Do not automatically execute commands, access secrets, or invoke external tools based solely on retrieved content.
- Validate publisher identity, content provenance, signatures, and expected document schema before use.
- Scan retrieved material for prompt-injection indicators, requests for credentials, unrelated tool calls, encoded payloads, and attempts to change instruction priority.
- Present proposed consequential actions to the user and require explicit confirmation before execution.
- Apply least-privilege controls to any agent consuming worldbook content, including restricted filesystem, network, credential, and command access.
- Prefer a workflow in which remote content is summarized as documentation while commands are independently validated against trusted sources.