T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:34
- Finding
- Untrusted Remote Prompts May Influence Active and Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-39` and `SKILL.md:53-55` **Vulnerability Type**: Untrusted external instruction ingestion and persistent instruction modification **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown If your human starts a test and gives you the test token, you can run it yourself: 1. GET `https://www.pwnclaw.com/api/test/{token}` → get the next prompt 2. POST `https://www.pwnclaw.com/api/test/{token}` with `{ "response": "your answer" }` → submit and get next 3. Repeat until status is "completed" 4. Results are in the dashboard ``` ```markdown ## After The Test PwnClaw generates specific security rules based on your vulnerabilities. Add them as permanent instructions in your agent's system prompt, then re-test to verify. ``` ### Technical Analysis The documented workflow instructs an agent to retrieve prompts from an external service and submit its answers to that service. No requirement is provided to validate the returned content, isolate the test environment, restrict available tools, or prevent externally supplied prompts from affecting the agent's current objectives. More critically, the document recommends adding externally generated rules as permanent system-prompt instructions. These rules originate outside the audited skill and may change after the skill itself has been reviewed. Installing them without human security review creates a persistent instruction-poisoning risk. If the external service, account, test token, network path, or generated results are compromised, attacker-controlled instructions could be presented as test prompts or security recommendations. Test responses may also contain information from the agent's context and are explicitly transmitted to the external service. ### Attack Path 1. A user or agent starts a test and receives a test token. 2. The agent retrieves the next test prompt from the external API. 3. An attacker who controls or compromises the service ...[truncated 1115 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Explicitly classify every prompt, result, and generated rule received from the external service as untrusted content. 2. Run security tests only against an isolated, disposable staging agent with synthetic data and no production credentials. 3. Disable or strictly allowlist tools during testing, particularly filesystem, shell, network, messaging, and administrative tools. 4. Never install generated rules automatically or copy them directly into a production system prompt. 5. Require a qualified human reviewer to inspect each proposed rule for hidden instructions, excessive permissions, conflicts with existing policy, and unrelated behavioral changes. 6. Convert approved recommendations into narrowly scoped internal rules rather than preserving externally supplied wording verbatim. 7. Display and document exactly what agent context and response data will be sent to the external service. 8. Use short-lived test tokens, protect them as credentials, and revoke them when testing completes. 9. Record all retrieved prompts, submitted responses, and approved configuration changes for later investigation. 10. Test persistent rule changes in a version-controlled staging configuration and provide a documented rollback procedure. ]]>