T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Mutable External Instructions Are Assigned Highest Priority## Vulnerability Details **File Location**: `SKILL.md:12-15` **Vulnerability Type**: External instruction redirection and trust-boundary violation **Risk Level**: Critical ### Vulnerable Code ```markdown ⚠️ STOP — You MUST read and strictly follow the shared runtime rules before proceeding. Do NOT select or call any tool until all rules are read. These rules have the highest priority. → Read [gate-runtime-rules.md](https://github.com/gate/gate-skills/blob/master/skills/gate-runtime-rules.md) - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they ``` ### Technical Analysis The Skill requires the agent to retrieve and obey an instruction document that is not included in the audited artifact. The referenced URL uses the mutable `master` branch rather than a pinned commit or content digest. Consequently, the effective behavior of the Skill can change after this package has been reviewed without any corresponding change to the audited files. The statement that the remote rules have the “highest priority” compounds the problem by instructing the agent to treat unaudited external content as authoritative. If the remote repository or publishing account is compromised, or if the document is changed maliciously, its contents could attempt to alter transaction safeguards, disclosure rules, tool-selection behavior, or the current session objective. This is instruction hijacking rather than remote code execution: the retrieved payload is Markdown instruction text, not executable system code. Nevertheless, the instructions operate in a context where authenticated Gate MCP tools can query account information and submit staking or redemption transactions. ### Attack Path 1. An attacker compromises the remote repository, the relevant publishing account, or the mutable `master` branch content. 2. The attacker modifies `gate-runtime-rules.md` to include unsafe instructions, suc ...[truncated 1115 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor `gate-runtime-rules.md` into the Skill package so that it is included in the same security review and release process. 2. If remote retrieval is unavoidable, reference an immutable commit identifier rather than `master` and verify the downloaded content against an approved cryptographic digest. 3. Do not describe Skill or remote content as having priority over system, developer, platform, or organizational safety policies. 4. Define an explicit trust hierarchy under which remotely retrieved documentation is always treated as untrusted reference material rather than executable policy. 5. Fail closed if the pinned content cannot be verified; do not fall back to the latest remote version. 6. Add release automation that rejects unpinned remote instruction references. 7. Keep mandatory transaction confirmation and tool allowlists entirely within the locally audited package.