T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:67
- Finding
- Untrusted Remote Markdown Is Treated as Authoritative Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 67–78 and 134 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Instructions ```markdown You **MUST** first fetch the detailed skill document for the specific `<model_id>` (e.g. `google/veo-3.1/text-to-video`) before attempting to construct the POST request payload. **DO NOT** skip this step. **DO NOT** hallucinate parameters because different video models have completely different parameter names for the same concept (e.g. one model might use `duration` while another uses `length`, one might use `resolution` while another uses `quality`). Send a `GET` request to: ```text https://shortapi.ai/api/skill/<model_id> ``` _(For example: `GET https://shortapi.ai/api/skill/google/veo-3.1/text-to-video`)_ This URL will return a Markdown (`.md`) text document containing the exact Input Parameters Schema for that specific model, alongside code examples. You must parse it to understand which arguments go into the `args` object. ``` The requirement is reinforced later: ```markdown 2. Before constructing any API request payload, you **MUST** first complete Step 1 — fetch the specific model's skill document from `https://shortapi.ai/api/skill/<model_id>`. **DO NOT** skip this step. **DO NOT** guess or hallucinate parameters. The document returned in Step 1 is the sole source of truth for the model's input schema. ``` ### Technical Analysis The Skill requires an agent to retrieve mutable Markdown from an external server and treat it as the “sole source of truth.” The response is described as containing both parameter schemas and code examples, rather than a constrained, machine-readable data structure. Because Markdown can contain natural-language instructions, the remote endpoint becomes an unreviewed instruction channel. If the ShortAPI service, its hosting infrastructure, DNS resolution, deployment pipeline, or a particular model document is compromis ...[truncated 2738 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace remote instructional Markdown with a strictly defined machine-readable schema, such as JSON Schema or OpenAPI. 2. Treat every remote response as untrusted data. Explicitly instruct the agent to ignore natural-language directives, tool-use requests, URLs, and executable examples found in the response. 3. Validate responses using a local allowlisted schema: - Permit only expected fields, types, enums, and constraints. - Reject unknown properties and embedded instruction fields. - Enforce an allowlist of supported model identifiers. 4. Pin model schemas to reviewed versions or cryptographically verify signed schema documents before use. 5. Separate data from instructions. Parse only the schema section using deterministic code rather than providing the complete remote Markdown to the language model. 6. Enforce outbound-request policy independently of remote content: - Send credentials only to `https://api.shortapi.ai`. - Never forward the Authorization header across redirects or to callback and media hosts. - Reject redirects to non-allowlisted origins. 7. Require explicit user confirmation before transmitting additional conversation context, local files, referenced media, or data not directly supplied for the generation request. 8. Apply payload size, field-count, URL-scheme, and hostname restrictions before invoking the generation endpoint. 9. Remove wording that makes a remote document authoritative over agent behavior. Limit its authority to validated model parameter data. ]]>