T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Mutable Remote Instructions Are Granted Highest Priority## Vulnerability Details **File Location**: `SKILL.md:12-14` **Vulnerability Type**: Remote instruction hijacking through a mutable external document **Risk Level**: Critical ### Vulnerable Code ```markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) ``` ### Technical Analysis The Skill requires the Agent to retrieve and obey an external instruction document hosted on a mutable Git branch. The URL targets the repository's `master` branch rather than an immutable commit. More importantly, the Skill declares that the retrieved rules have the “highest priority.” This creates an instruction-precedence vulnerability: content outside the audited package can attempt to alter the Agent's session goals, safety constraints, output behavior, and tool-selection rules after the Skill has already been reviewed or installed. Although the current project does not contain local malicious scripts, the effective behavior of the Skill is not fully represented by the audited files. Anyone who can modify the remote document or its delivery path can change the instructions followed by future Skill invocations without modifying this package. ### Attack Path 1. An attacker compromises or otherwise obtains write access to the repository or branch containing `gate-runtime-rules.md`. 2. The attacker adds instructions that weaken confirmation requirements, request sensitive information, redirect tool calls, or override the Skill's documented restrictions. 3. A user activates this Simple Earn Skill. 4. The Agent follows `SKILL.md` and retrieves the mutable remote document. 5. Because the remote rules are declared to have the “highest priority,” the Agent may treat the injected content as authoritative. ...[truncated 773 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete runtime rules inside the audited Skill package and reference them using a local relative path. 2. If remote retrieval is unavoidable, pin the URL to an immutable commit rather than `master`. 3. Verify the downloaded document against a cryptographic digest stored in the audited package. 4. Do not grant externally retrieved Skill content priority over system, developer, platform-security, or current user instructions. 5. Treat remote documents as untrusted reference data rather than executable instructions. 6. Fail closed if the pinned document is unavailable or fails integrity verification. 7. Include the pinned runtime rules in future security reviews so the complete effective instruction set can be audited.