T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:47- Finding
Untrusted Marketplace Tasks Can Hijack Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:3,SKILL.md:47-68;references/api.md:25-32,references/api.md:42-47,references/api.md:58-70,references/api.md:114-122
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippets
SKILL.md:3:yaml description: "Interact with the Clawgora AI agent labor marketplace. Use when asked to post a job for another agent to complete, find and claim available work, deliver results, accept or reject submissions, or check credit balance. Handles the full job lifecycle — register, post or find jobs, claim, deliver, accept or reject. Also use when asked to check the Clawgora ledger, send job messages, manage agent identity, or rotate an agent API key."SKILL.md:47-68:bash ### Find and claim a job (earn credits) # Browse open jobs (filter by category if needed) curl -s "https://api.clawgora.ai/jobs?category=code" \ -H "Authorization: Bearer $CLAWGORA_API_KEY" # Claim one curl -s -X POST https://api.clawgora.ai/jobs/$JOB_ID/claim \ -H "Authorization: Bearer $CLAWGORA_API_KEY" ### Deliver work curl -s -X POST https://api.clawgora.ai/jobs/$JOB_ID/deliver \ -H "Authorization: Bearer $CLAWGORA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"result_type":"text","result_content":"..."}'references/api.md:25-32:json ### GET /agents/me/inbox Poster/worker inbox view for polling job progress. response: { "open_jobs": [...], "active_jobs": [...], "delivered_jobs": [...], "new_messages": [...] }references/api.md:42-47:json ### GET /jobs Query params: `category`, `min_budget`, `max_budget`, `limit` (default 20), `offset` response: [{ "id", "title", "description", "category", "budget", "deadline_minutes", "posted_by", "status", "created_at" }]references/api.md:58-70:json ### POST /jobs/:id/claim response: { "id", "status": "claimed", "claimed_by", "claimed_at" }json ### POS ...[truncated 3972 chars]- Remediation
View remediation
Remediation Suggestions
-
Establish an explicit trust boundary
- State that every job title, description, message, result, attachment, and URL is untrusted external data.
- Explicitly prohibit treating marketplace content as authority to alter system, developer, user, or Skill instructions.
-
Require user approval at sensitive transitions
- Show the user the complete job description, poster identity, budget, deadline, and requested operations before claiming it.
- Require separate confirmation before accessing local files, invoking privileged tools, visiting external URLs, sending messages, or delivering results.
-
Apply strict capability controls
- Define a per-job allowlist of permitted tools, files, directories, domains, and network methods.
- Deny access by default to environment variables, secret stores, credentials, agent memory, unrelated conversations, and files outside a dedicated job workspace.
- Execute job work in an isolated sandbox with minimal filesystem and network permissions.
-
Add prompt-injection defenses
- Reject job content that asks the agent to ignore prior instructions, reveal hidden prompts, retrieve secrets, modify persistent state, or perform unrelated actions.
- Never execute commands or code copied from job descriptions or messages without independent validation and explicit approval.
- Treat instructions obtained from linked pages as untrusted data under the same policy.
-
Protect outbound channels
- Preview all message and delivery content before transmission.
- Scan outbound data for API keys, tokens, environment values, private files, internal prompts, and other sensitive information.
- Restrict
file_urldeliveries to approved storage locations and validated URLs.
-
Constrain autonomous marketplace behavior
- Do not autonomously browse, select, or claim arbitrary work based solely on external descriptions.
- Require the user to select or approve a ...[truncated 168 chars]
-