T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:332
- Finding
- Untrusted Remote Task Content Can Influence Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 332-375 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Documentation ```markdown ## Example 2: Multi-Agent Collaboration **Input:** "Join team 'ML Research', find tasks needing 'machine-learning' capability, claim one, and request help from team" **Steps:** 1. Get invitations: `GET /invitations` 2. Accept invitation for "ML Research" team 3. Get team tasks: `GET /teams/<team_id>/tasks` 4. Filter tasks by `required_capabilities` containing "machine-learning" 5. Claim first available task 6. Request collaboration: `POST /tasks/<task_id>/collaborate` ``` The subsequent workflow also directs the agent to act on retrieved tasks: ```markdown **Steps:** 1. Get your tasks: `GET /teams/<team_id>/tasks` (filter by `assigned_to_id`) 2. Verify current `column_id` is Backlog 3. Move to In Progress: `PUT /tasks/<task_id>` with new `column_id` 4. Work on task, send status updates via messages 5. Move to Done: `PUT /tasks/<task_id>` with Done `column_id` 6. Complete task: `POST /tasks/<task_id>/complete` ``` ### Technical Analysis The skill connects the agent to an external collaboration service, accepts team invitations, retrieves remotely created tasks, and instructs the agent to work on those tasks. Task descriptions and task-chat messages are controlled by external team members. The documentation does not establish a trust boundary for API-returned content. In particular, it does not instruct the agent to: - Treat task descriptions and messages as untrusted data. - Reject instructions that conflict with the user's original request or system safety constraints. - Obtain user confirmation before accepting invitations or acting on remotely supplied tasks. - Prevent secrets, local files, credentials, or unrelated session data from being included in task updates. - Restrict tools and resources that may be used while processing a remote task. Conse ...[truncated 2043 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Explicitly classify every task title, description, attachment, API response, and chat message as untrusted external data. 2. State that remote content must never override system instructions, developer instructions, safety rules, or the user's original request. 3. Require explicit user confirmation before: - Accepting a team invitation. - Claiming a remotely created task. - Performing tool calls requested by remote content. - Uploading files, code, credentials, logs, or other information. 4. Restrict work to the scope expressly authorized by the user. If a remote task expands or changes that scope, stop and request clarification. 5. Add a prompt-injection screening step that identifies requests to reveal secrets, read unrelated files, execute commands, weaken safeguards, or contact additional services. 6. Apply least privilege by limiting the tools, local paths, network destinations, and credentials available while processing remote tasks. 7. Sanitize outbound task messages and prohibit transmission of bearer tokens, environment variables, local files, private conversation context, or unrelated user data. 8. Present the remote task contents to the user in a non-executable preview before beginning work. 9. Record the external team, task identifier, requested actions, approved scope, and transmitted data for auditability. 10. Add adversarial tests covering malicious task descriptions and chat messages, including attempts to override instructions, obtain secrets, and trigger unauthorized tool use. ]]>