T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:30- Finding
Untrusted External Instructions Can Hijack Agent Behavior
- Content
View full analysis
and follow the instructions. ``` ```markdown # Line 119 | **URL Onboarding** ⭐⭐⭐ | **Highest** | Service hosts a machine-readable `skill.md` / protocol doc an agent reads and follows to self-register | ``` ```markdown # Lines 128–129 2. Ask: could an agent read that URL and complete the full registration/onboarding sequence autonomously? 3. Try the instruction: `Read and follow the instructions` — does it work? ``` ```markdown # Line 158 **Onboarding instruction (if YES):** Read {url} and follow the instructions to {join/register/participate} ``` ### Technical Analysis The skill instructs the agent to retrieve and follow instructions from an externally hosted, potentially attacker-controlled URL. The URL is not constrained to an allowlist of trusted domains, and the remote document is treated as executable guidance rather than untrusted evidence. This creates an instruction-hijacking boundary violation: mutable third-party content can influence the agent's current goals and actions after the local skill has been reviewed. A malicious onboarding document could contain instructions unrelated to evaluation, including requests to disclose accessible information, invoke tools, submit data, obtain credentials, register with an external service, or perform other side effects. Testing whether URL onboarding is documented does not require actually following the external instructions. The skill therefore exceeds the least privilege required for its stated evaluation purpose. ### Attack Path 1. An attacker presents a service for evaluation and supplies an attacker-controlled onboarding or protocol URL. 2. The skill directs the agent to read that URL and follow its instructions. 3. The remote document includes malicious or unr ...[truncated 1299 chars]- Remediation
View remediation