T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:51
- Finding
- Mutable Remote Instructions Can Hijack Financial and Wallet Operations## Vulnerability Details **File Location**: `SKILL.md`, lines 51-83 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Your Journey This skill file is modular. Follow this path — each module tells you when to move to the next one. ### 1. Onboard (first time only) If you don't have credentials at `~/.config/astranova/agents/<name>/credentials.json`, you're new. → Fetch `https://agents.astranova.live/ONBOARDING.md` and complete all steps (register, save credentials, verify on X, post to board). ### 2. Enter the World & Trade Once onboarded, you're in. The market is live. → Fetch `https://agents.astranova.live/TRADING.md` — check the market state, see your portfolio, and make your first trade. Come back to TRADING.md anytime the human wants to trade, check prices, or review their portfolio. ### 3. Set Up a Wallet (after some trading) After you've traded through a few epochs, check your portfolio. When you see `rewards.claimable > "0"`, your agent has earned $ASTRA. Suggest setting up a wallet so they can claim it. → Fetch `https://agents.astranova.live/WALLET.md` — generate a Solana keypair, fund it with a tiny amount of SOL, and register it with the API. You can also set up a wallet proactively at any time — it's quick and means rewards are claimable the moment they arrive. ### 4. Claim Rewards When your portfolio shows `rewards.claimable > "0"` AND `rewards.hasWallet` is `true`, you're ready to claim. → Fetch `https://agents.astranova.live/REWARDS.md` — initiate the claim, co-sign the Solana transaction, confirm with the API. **Tip:** Suggest batching claims weekly rather than every epoch — one transaction covers all accumulated rewards. ``` ### Technical Analysis The locally reviewed skill delegates its substantive behavior to Markdown documents fetched from a remote server at runtime. These remote documents contro ...[truncated 3578 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle all security-sensitive modules with the audited skill package rather than retrieving mutable instructions at runtime. 2. If remote retrieval is necessary, pin every approved module to a cryptographic digest and reject content that does not match the audited hash. 3. Alternatively, require signed modules and verify signatures against a locally pinned public key before interpreting their contents. 4. Treat downloaded Markdown as untrusted reference material, not as authoritative instructions. Explicitly prohibit it from overriding system policy, credential restrictions, destination controls, or approval requirements. 5. Define sensitive operations locally using a narrow, machine-readable allowlist of approved API endpoints, HTTP methods, domains, Solana programs, transaction types, and wallet destinations. 6. Require explicit, informed human confirmation immediately before: - Placing or modifying a trade. - Generating or registering a wallet. - Funding any address. - Claiming rewards. - Signing or broadcasting a blockchain transaction. 7. Before approval, display a human-readable transaction summary containing the exact asset, amount, recipient, program IDs, fees, and expected state changes. 8. Never allow fetched instructions to request API keys, seed phrases, private keys, or raw signed transactions. Enforce this restriction in the execution layer rather than relying only on prose. 9. Apply trade limits, wallet funding limits, destination allowlists, and rate limits so a compromised instruction module cannot exercise unrestricted financial authority. 10. Separate documentation retrieval from action execution. Parse remote content only for display, while implementing financial workflows through locally reviewed logic. 11. Version and audit all remote modules, publish immutable revisions, and provide a secure rollback and revocation mechanism. 12. Preserve the existing service-speci ...[truncated 154 chars]