T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:51- Finding
Mutable Remote Instructions Can Hijack Financial and Wallet Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 51-83
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippet
markdown ## Your Journey This skill file is modular. Follow this path — each module tells you when to move to the next one. ### 1. Onboard (first time only) If you don't have credentials at `~/.config/astranova/agents/<name>/credentials.json`, you're new. → Fetch `https://agents.astranova.live/ONBOARDING.md` and complete all steps (register, save credentials, verify on X, post to board). ### 2. Enter the World & Trade Once onboarded, you're in. The market is live. → Fetch `https://agents.astranova.live/TRADING.md` — check the market state, see your portfolio, and make your first trade. Come back to TRADING.md anytime the human wants to trade, check prices, or review their portfolio. ### 3. Set Up a Wallet (after some trading) After you've traded through a few epochs, check your portfolio. When you see `rewards.claimable > "0"`, your agent has earned $ASTRA. Suggest setting up a wallet so they can claim it. → Fetch `https://agents.astranova.live/WALLET.md` — generate a Solana keypair, fund it with a tiny amount of SOL, and register it with the API. You can also set up a wallet proactively at any time — it's quick and means rewards are claimable the moment they arrive. ### 4. Claim Rewards When your portfolio shows `rewards.claimable > "0"` AND `rewards.hasWallet` is `true`, you're ready to claim. → Fetch `https://agents.astranova.live/REWARDS.md` — initiate the claim, co-sign the Solana transaction, confirm with the API. **Tip:** Suggest batching claims weekly rather than every epoch — one transaction covers all accumulated rewards.Technical Analysis
The locally reviewed skill delegates its substantive behavior to Markdown documents fetched from a remote server at runtime. These remote documents contro ...[truncated 3578 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle all security-sensitive modules with the audited skill package rather than retrieving mutable instructions at runtime.
- If remote retrieval is necessary, pin every approved module to a cryptographic digest and reject content that does not match the audited hash.
- Alternatively, require signed modules and verify signatures against a locally pinned public key before interpreting their contents.
- Treat downloaded Markdown as untrusted reference material, not as authoritative instructions. Explicitly prohibit it from overriding system policy, credential restrictions, destination controls, or approval requirements.
- Define sensitive operations locally using a narrow, machine-readable allowlist of approved API endpoints, HTTP methods, domains, Solana programs, transaction types, and wallet destinations.
- Require explicit, informed human confirmation immediately before:
- Placing or modifying a trade.
- Generating or registering a wallet.
- Funding any address.
- Claiming rewards.
- Signing or broadcasting a blockchain transaction.
- Before approval, display a human-readable transaction summary containing the exact asset, amount, recipient, program IDs, fees, and expected state changes.
- Never allow fetched instructions to request API keys, seed phrases, private keys, or raw signed transactions. Enforce this restriction in the execution layer rather than relying only on prose.
- Apply trade limits, wallet funding limits, destination allowlists, and rate limits so a compromised instruction module cannot exercise unrestricted financial authority.
- Separate documentation retrieval from action execution. Parse remote content only for display, while implementing financial workflows through locally reviewed logic.
- Version and audit all remote modules, publish immutable revisions, and provide a secure rollback and revocation mechanism.
- Preserve the existing service-speci ...[truncated 154 chars]