T01 · Skill Instruction Hijacking
Error
- Location
- references/workflow.md:30
- Finding
- Untrusted Third-Party Skill Instructions Enter the Agent Execution Context## Vulnerability Details **File Location**: `references/workflow.md:30-58` **Related Location**: `references/surfaces.md:148-175` **Vulnerability Type**: Untrusted instructions used as Agent execution context **Risk Level**: High **Relevant code snippet:** ```markdown **Resolution preference:** 1. Free API, no auth → `web_fetch` 2. Free API, key via signup → throwaway identity + `web_fetch` 3. MCP server → `mcporter call {url}.{tool}` or direct HTTP 4. Downloaded skill → read SKILL.md as context **All network calls use retry logic** (see `references/resilience.md` §Retry). 3 attempts, exponential backoff, before skipping. **Identity provisioning** (only when needed): create throwaway inbox from cascade in `references/resilience.md` §Identity. Use BotEmail first (longest-lived). If all providers fail, proceed without signup capability — restrict to no-auth candidates only. **When a candidate fails** (signup blocked, gate hit, endpoint down): - Skip to next candidate. If no candidates remain, try the next approach from Phase 1. - If all approaches exhausted, apply reframing tactics from `references/resilience.md` §Reframing. - If reframing fails, proceed to Phase 4 and produce a failure report. **When a gate is hit** (CAPTCHA, browser login, SMS): - Search installed skills and MCP servers for a handler (see `references/resilience.md` §Gates). Max search depth: 1 (do not search for handlers of handlers). - If handler found, use it. If not, skip the service. Write `manifest.json` with status `resolved`. ## Phase 3: Execute Spawn `worker:execute` with the resolved tools and the fallback approach baked into the task description so it can pivot without returning to the orchestrator. The worker: - Calls APIs via `web_fetch` (with retry) - Calls MCP servers via `mcporter call` by URL or direct HTTP - Uses downloaded SKILL.md as context - Uses session identity for signups ``` The external discovery p ...[truncated 3505 chars]
- Remediation
- ## Remediation Suggestions 1. Do not place downloaded `SKILL.md` or README contents into the worker's governing instruction context. 2. Treat remote Skill content strictly as untrusted data and parse only an allowlisted schema containing fields such as name, version, interface, and required parameters. 3. Require a local static security review before any downloaded Skill instructions can influence execution. 4. Enforce task-scoped capabilities independently of candidate content: - Restrict filesystem access to the session directory. - Restrict network access to explicitly selected endpoints. - Expose only the MCP methods required for the original task. - Deny access to unrelated credentials and host configuration. 5. Bind every action to the original user request and reject candidate instructions that introduce unrelated objectives, destinations, files, or credentials. 6. Separate planning data from executable instructions using a structured intermediate representation rather than natural-language context. 7. Record the exact candidate source and immutable revision, and present the reviewed action plan before executing any candidate that contains imperative instructions. 8. Treat external security scans and reputation signals only as supplementary evidence, not as authorization to execute instruction text.