T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:25- Finding
Blind Delegation of Agent Control to Mutable External Instructions
- Content
View full analysis
and follow the instructions. ``` ```markdown | Service | Onboarding instruction | |---|---| | **Moltbook** | `Read https://www.moltbook.com/skill.md and follow the instructions to register and join` | | **Ensue / autoresearch@home** | `Read https://ensue.dev/docs and call POST /auth/agent-register` OR `Read https://raw.githubusercontent.com/mutable-state-inc/autoresearch-at-home/master/collab.md and follow the instructions to join` | ``` The recommendation template repeats this behavior at line 132: ```markdown Read https://www.moltbook.com/skill.md and follow the instructions to register and join. ``` ### Technical Analysis The skill instructs an agent to retrieve remotely hosted documents and follow their instructions without defining a trust boundary, validating the retrieved content, or limiting the operations that the remote instructions may request. It explicitly prioritizes this onboarding method and presents autonomous registration as immediately executable behavior. The effective instructions are not contained in the audited project and may change after review. If an external endpoint, hosting account, domain, or upstream repository is compromised, its content can be replaced with instructions that redirect the agent's current objective or induce it to invoke available tools. The risk is not limited to passive retrieval because the documented workflow explicitly includes registration and an HTTP state-changing operation: ```text POST /auth/agent-register ``` Consequently, loading and applying the remote document can cross from reading untrusted content into performing externally controlled actions. ### Attack Path 1. A user asks the agent to recommend or join a supported agent-native service. 2. The skill priorit ...[truncated 1592 chars]- Remediation
View remediation