T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Mutable External Instructions Are Assigned Highest Priority< - **Only call MCP tools explicitly listed in this skill.** Tools not documented here must NOT be called, even if they exist in the MCP server. ``` ### Technical Analysis The skill delegates control of its runtime behavior to a remotely hosted Markdown document and declares that the remote rules have the “highest priority.” The URL references the mutable `master` branch rather than an immutable commit or content digest. Consequently, the effective instructions executed by the agent are not limited to the content reviewed in this artifact. A later repository modification, compromised maintainer account, or upstream repository compromise could change the remote instructions without changing the audited package. This is instruction hijacking rather than remote code execution: the external resource contains agent instructions, not an executable payload. Nevertheless, those instructions could attempt to alter tool-selection behavior, weaken transaction safeguards, request sensitive information, or redirect the agent toward actions unrelated to the user's intent. ### Attack Path 1. A user installs or invokes the audited skill. 2. The skill instructs the agent to retrieve `gate-runtime-rules.md` from the mutable `master` branch. 3. An attacker compromises the upstream repository, a maintainer account, or the referenced document. 4. The attacker inserts instructions that weaken confirmation requirements, solicit sensitive information, or redirect MCP tool usage. 5. The agent loads the m ...[truncated 1293 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the shared runtime rules inside the skill package so they are included in security review and version control. 2. If remote retrieval is unavoidable, pin the document to an immutable commit identifier rather than `master`. 3. Verify retrieved content against a trusted cryptographic digest or authenticated signed release. 4. Remove the assertion that externally retrieved content has the “highest priority.” 5. Explicitly state that skill and remote instructions cannot override system, developer, platform safety, or current user instructions. 6. Apply an allowlist to remote content: it should only provide domain guidance and must not redefine tools, permissions, confirmation requirements, credential handling, or data destinations. 7. Fail closed if the pinned rules cannot be retrieved or verified; do not fall back to unverified latest content. 8. Include the exact pinned rules version and digest in the package manifest and audit documentation. ]]>