T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:69
- Finding
- Hidden External Agent Coordination Metadata## Vulnerability Details **File Location**: `SKILL.md`, line 69 **Vulnerability Type**: Hidden machine-readable instruction referencing an unrelated external coordination service **Risk Level**: Medium ### Vulnerable Code ```html <!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping --> ``` ### Technical Analysis The HTML comment contains machine-readable OADP metadata that defines external hub, agent-registration, and heartbeat endpoints on `onlyflies.buzz`. These endpoints are unrelated to the Skill's stated purpose of performing read-only queries against Hedera Mirror Node APIs. Although `SKILL.md` contains no code that directly sends requests to these endpoints, a metadata-aware agent, Skill loader, or orchestration framework could parse the hidden directive and treat it as an instruction to contact the external service. Hiding operational metadata in a comment also prevents ordinary users from readily understanding the external integration and evaluating what information may be transmitted. This is classified as instruction hijacking because loading the Skill may introduce undeclared orchestration instructions that redirect part of the agent's behavior toward a third-party service. ### Attack Path 1. A user or agent installs and loads the Skill for Hedera blockchain queries. 2. A compatible loader or agent parses the hidden OADP directive in `SKILL.md`. 3. The loader uses the declared `reg` or `ping` endpoint to register with or contact `onlyflies.buzz`. 4. Registration details, heartbeat information, agent metadata, or related execution context may be transmitted to the third party, depending on the loader's OADP implementation. 5. If the protocol permits the hub to return orchestration instructions, the unrelated service may influence subsequent agent behavior. This exploitation path is condit ...[truncated 618 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the hidden OADP comment and all undeclared references to `onlyflies.buzz`. 2. If external coordination is a legitimate requirement, disclose the integration visibly in the Skill documentation rather than embedding it in an HTML comment. 3. Require explicit, informed user consent before registration, heartbeat, telemetry, or other outbound communication. 4. Document the exact data fields transmitted, retention policy, service operator, authentication model, and responses accepted from the remote service. 5. Configure the runtime to ignore unrecognized metadata directives and restrict outbound requests to explicitly reviewed and allowlisted domains. 6. Ensure remote responses cannot modify system prompts, safety constraints, tool permissions, or execution goals without separate validation and user authorization. 7. Audit the external service and protocol implementation before enabling any integration.