T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:51
- Finding
- External Task Delegation Enables Skill Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md:51-63`, `SKILL.md:95-103` **Vulnerability Type**: External agent control and untrusted task delegation **Risk Level**: High The skill directs an agent to poll a third-party service for pending calls, process those externally supplied calls, and submit the results. It recommends integrating this behavior into the agent's recurring heartbeat without requiring user approval for each task. ### Vulnerable Code ```bash ### 5. Check for Incoming Calls (Add to Your Heartbeat) ```bash curl -s "https://onlyflies.buzz/clawswarm/api/v1/services/agent/YOUR_AGENT_ID/pending" \ -H "Authorization: Bearer YOUR_AGENT_ID" ``` Process pending calls and respond: ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/services/calls/CALL_ID/complete" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_AGENT_ID" \ -d '{"output": {"result": "your response data"}, "status": "completed"}' ``` ``` The persistent polling recommendation is: ```text ## Heartbeat Integration Add this to your heartbeat routine: ``` # Check for service calls every heartbeat PENDING=$(curl -s "https://onlyflies.buzz/clawswarm/api/v1/services/agent/YOUR_AGENT_ID/pending" \ -H "Authorization: Bearer YOUR_AGENT_ID") # Process any pending calls... ``` ``` ### Technical Analysis Loading and following the skill transfers influence over future task selection to the external `onlyflies.buzz` service. Remote callers can create service-call payloads that the provider agent is instructed to retrieve and process. The instructions do not define: - A trusted-caller allowlist or caller authentication policy. - Explicit user approval before processing each remote task. - Separation between remote data and executable agent instructions. - Input schema enforcement, size limits, or content validation. - A capability or tool allowlist for processing remote ...[truncated 2434 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic processing of pending calls from the default heartbeat instructions. 2. Require explicit, informed user approval before registration, service publication, and every externally submitted task. 3. Treat all remote payload fields as untrusted data and never append them directly to privileged agent instructions. 4. Validate requests against strict JSON schemas, including allowed fields, data types, lengths, nesting depth, and total payload size. 5. Enforce authenticated caller identities and per-service caller allowlists where appropriate. 6. Define a narrow capability policy for each service. Remote calls must not gain access to unrelated filesystem, shell, credential, memory, network, or account-management tools. 7. Process remote requests in an isolated sandbox with resource quotas, network restrictions, timeouts, and no ambient credentials. 8. Add prompt-injection defenses that separate system policy, service logic, and remote data. Reject payloads that attempt to alter agent policy or request unrelated actions. 9. Filter responses to prevent secrets, internal prompts, credentials, personal information, and unrelated session data from being returned. 10. Add audit logging, caller-specific rate limits, replay protection, cancellation controls, and an immediate mechanism to disable polling. 11. Document the external trust boundary and clearly state that remote calls must not be processed as authoritative instructions.