T01 · Skill Instruction Hijacking
Error
- Location
references/workflow.md:30- Finding
Untrusted Third-Party Skill Instructions Enter the Agent Execution Context
- Content
View full analysis
Vulnerability Details
File Location:
references/workflow.md:30-58
Related Location:references/surfaces.md:148-175
Vulnerability Type: Untrusted instructions used as Agent execution context
Risk Level: HighRelevant code snippet:
markdown **Resolution preference:** 1. Free API, no auth → `web_fetch` 2. Free API, key via signup → throwaway identity + `web_fetch` 3. MCP server → `mcporter call {url}.{tool}` or direct HTTP 4. Downloaded skill → read SKILL.md as context **All network calls use retry logic** (see `references/resilience.md` §Retry). 3 attempts, exponential backoff, before skipping. **Identity provisioning** (only when needed): create throwaway inbox from cascade in `references/resilience.md` §Identity. Use BotEmail first (longest-lived). If all providers fail, proceed without signup capability — restrict to no-auth candidates only. **When a candidate fails** (signup blocked, gate hit, endpoint down): - Skip to next candidate. If no candidates remain, try the next approach from Phase 1. - If all approaches exhausted, apply reframing tactics from `references/resilience.md` §Reframing. - If reframing fails, proceed to Phase 4 and produce a failure report. **When a gate is hit** (CAPTCHA, browser login, SMS): - Search installed skills and MCP servers for a handler (see `references/resilience.md` §Gates). Max search depth: 1 (do not search for handlers of handlers). - If handler found, use it. If not, skip the service. Write `manifest.json` with status `resolved`. ## Phase 3: Execute Spawn `worker:execute` with the resolved tools and the fallback approach baked into the task description so it can pivot without returning to the orchestrator. The worker: - Calls APIs via `web_fetch` (with retry) - Calls MCP servers via `mcporter call` by URL or direct HTTP - Uses downloaded SKILL.md as context - Uses session identity for signupsThe external discovery p ...[truncated 3505 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place downloaded
SKILL.mdor README contents into the worker's governing instruction context. - Treat remote Skill content strictly as untrusted data and parse only an allowlisted schema containing fields such as name, version, interface, and required parameters.
- Require a local static security review before any downloaded Skill instructions can influence execution.
- Enforce task-scoped capabilities independently of candidate content:
- Restrict filesystem access to the session directory.
- Restrict network access to explicitly selected endpoints.
- Expose only the MCP methods required for the original task.
- Deny access to unrelated credentials and host configuration.
- Bind every action to the original user request and reject candidate instructions that introduce unrelated objectives, destinations, files, or credentials.
- Separate planning data from executable instructions using a structured intermediate representation rather than natural-language context.
- Record the exact candidate source and immutable revision, and present the reviewed action plan before executing any candidate that contains imperative instructions.
- Treat external security scans and reputation signals only as supplementary evidence, not as authorization to execute instruction text.
- Do not place downloaded