T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:14
- Finding
- Mutable Remote Instructions Are Assigned Highest Priority## Vulnerability Details **File Location**: `SKILL.md`, lines 14–17 **Vulnerability Type**: Remote instruction override through a mutable external document **Risk Level**: Critical ```markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server. ``` ### Technical Analysis The Skill requires the Agent to retrieve instructions from an external GitHub URL and explicitly declares those instructions to have the “highest priority.” The URL references the mutable `master` branch rather than an immutable commit. Consequently, the effective Skill instructions can change after the local package has been reviewed. This creates an instruction-hijacking boundary: anyone able to modify the referenced repository content, compromise the repository, or influence remote content delivery could alter the Agent's behavior without changing the audited artifact. The priority statement compounds the issue by attempting to elevate unaudited external content over the Skill's local controls. Although no malicious remote payload was established during this static audit, the local instruction itself creates a confirmed mechanism through which mutable external text can control the current Agent session. ### Attack Path 1. A user invokes the Skill for an Alpha market or trading operation. 2. The Agent loads `SKILL.md`. 3. Lines 14–16 require the Agent to retrieve the remote runtime-rules document from the mutable `master` branch. 4. An attacker with control over the remote repository, its publishing process, or content delivery modifies that document. 5. The modified d ...[truncated 977 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the complete runtime rules into the Skill package so they are reviewed together with the rest of the artifact. 2. If external retrieval is unavoidable, reference an immutable commit rather than `master`. 3. Publish and verify a cryptographic digest or signature for the external document before processing it. 4. Remove the statement that remote instructions have the “highest priority.” 5. Explicitly state that all Skill and remote instructions remain subordinate to platform, system, developer, user-authorization, and transaction-safety constraints. 6. Fail closed if the pinned content cannot be retrieved or its integrity cannot be verified. 7. Prevent external runtime rules from changing the approved MCP tool allowlist or bypassing quote, confirmation, and order-verification controls.