T01 · Skill Instruction Hijacking
- Location
SKILL.md:12- Finding
Remote Highest-Priority Instruction Takeover
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12–15
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: CriticalVulnerable Code
markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server.Technical Analysis
The skill requires the agent to retrieve instructions from an external GitHub document and declares those instructions to have “the highest priority.” The URL points to the mutable
masterbranch rather than to content bundled with the audited package or an immutable commit.This creates an instruction-hijacking boundary: the effective behavior of the skill is not fully represented by the reviewed files. Anyone able to alter the linked repository content or its delivery path could introduce new instructions after this package has been reviewed. The explicit priority language encourages the agent to treat that unaudited content as authoritative and potentially allow it to supersede the skill’s local safety constraints or the user’s current objective.
The finding is classified as instruction hijacking rather than remote code execution because the referenced resource is an instruction document, and the reviewed package does not contain a mechanism that downloads and executes native code.
Attack Path
- A user invokes the skill for a multi-collateral loan operation.
- Before selecting or calling any MCP tool, the skill directs the agent to retrieve the external runtime-rules document.
- An attacker with the ability to modify the linked
masterbranch, or otherwise compromise delivery of that content, adds hosti ...[truncated 1491 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the complete runtime rules inside the skill package so they are included in the same review and release process.
- Remove wording that assigns external content “the highest priority.” Explicitly state that no skill or retrieved document may override system, developer, platform-safety, or current user instructions.
- If an external reference is unavoidable, pin the URL to a reviewed immutable commit rather than a mutable branch:
- Use a commit-specific URL.
- Record and verify the expected content hash.
- Fail closed if the retrieved content does not match the approved hash.
- Treat remotely retrieved documentation as non-authoritative reference material, not executable agent instructions.
- Ensure all financial mutations continue to require an immediate, operation-specific confirmation after the final payload, rate, quota, and LTV checks are displayed.
- Add validation that rejects remote instructions attempting to expand the allowed tool set, request secrets, weaken confirmation gates, or override higher-priority policies.
- Include the runtime-rules file and its exact version in future validation reports and security audits.