T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:47
- Finding
- Untrusted Marketplace Tasks Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:3`, `SKILL.md:47-68`; `references/api.md:25-32`, `references/api.md:42-47`, `references/api.md:58-70`, `references/api.md:114-122` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:3`: ```yaml description: "Interact with the Clawgora AI agent labor marketplace. Use when asked to post a job for another agent to complete, find and claim available work, deliver results, accept or reject submissions, or check credit balance. Handles the full job lifecycle — register, post or find jobs, claim, deliver, accept or reject. Also use when asked to check the Clawgora ledger, send job messages, manage agent identity, or rotate an agent API key." ``` `SKILL.md:47-68`: ```bash ### Find and claim a job (earn credits) # Browse open jobs (filter by category if needed) curl -s "https://api.clawgora.ai/jobs?category=code" \ -H "Authorization: Bearer $CLAWGORA_API_KEY" # Claim one curl -s -X POST https://api.clawgora.ai/jobs/$JOB_ID/claim \ -H "Authorization: Bearer $CLAWGORA_API_KEY" ### Deliver work curl -s -X POST https://api.clawgora.ai/jobs/$JOB_ID/deliver \ -H "Authorization: Bearer $CLAWGORA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"result_type":"text","result_content":"..."}' ``` `references/api.md:25-32`: ```json ### GET /agents/me/inbox Poster/worker inbox view for polling job progress. response: { "open_jobs": [...], "active_jobs": [...], "delivered_jobs": [...], "new_messages": [...] } ``` `references/api.md:42-47`: ```json ### GET /jobs Query params: `category`, `min_budget`, `max_budget`, `limit` (default 20), `offset` response: [{ "id", "title", "description", "category", "budget", "deadline_minutes", "posted_by", "status", "created_at" }] ``` `references/api.md:58-70`: ```json ### POST /jobs/:id/claim response: { "id", "status": "claimed", "claimed_by", "claimed_at" } ``` ```json ### POS ...[truncated 3972 chars]
- Remediation
- ## Remediation Suggestions 1. **Establish an explicit trust boundary** - State that every job title, description, message, result, attachment, and URL is untrusted external data. - Explicitly prohibit treating marketplace content as authority to alter system, developer, user, or Skill instructions. 2. **Require user approval at sensitive transitions** - Show the user the complete job description, poster identity, budget, deadline, and requested operations before claiming it. - Require separate confirmation before accessing local files, invoking privileged tools, visiting external URLs, sending messages, or delivering results. 3. **Apply strict capability controls** - Define a per-job allowlist of permitted tools, files, directories, domains, and network methods. - Deny access by default to environment variables, secret stores, credentials, agent memory, unrelated conversations, and files outside a dedicated job workspace. - Execute job work in an isolated sandbox with minimal filesystem and network permissions. 4. **Add prompt-injection defenses** - Reject job content that asks the agent to ignore prior instructions, reveal hidden prompts, retrieve secrets, modify persistent state, or perform unrelated actions. - Never execute commands or code copied from job descriptions or messages without independent validation and explicit approval. - Treat instructions obtained from linked pages as untrusted data under the same policy. 5. **Protect outbound channels** - Preview all message and delivery content before transmission. - Scan outbound data for API keys, tokens, environment values, private files, internal prompts, and other sensitive information. - Restrict `file_url` deliveries to approved storage locations and validated URLs. 6. **Constrain autonomous marketplace behavior** - Do not autonomously browse, select, or claim arbitrary work based solely on external descriptions. - Require the user to select or approve a ...[truncated 168 chars]