T01 · Skill Instruction Hijacking
Error
- Location
- encrypted-card.md:83
- Finding
- Server-Controlled Instructions Are Executed by an Authenticated Sub-Agent<![CDATA[ ## Vulnerability Details **File Location**: `encrypted-card.md:83-100`, `encrypted-card.md:148-157` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Vulnerable Code ```json { "approved": true, "checkout_id": "r5chk_abc123", "checkout_steps": [ "Call POST /api/v1/bot/rail5/key with { \"checkout_id\": \"r5chk_abc123\" } to get the decryption key.", "Run: node decrypt.js <key_hex> <iv_hex> <tag_hex> Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` ```text ### Step 2: Spawn a Sub-Agent Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response: sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) The sub-agent executes the `checkout_steps` in sequence. You (the main agent) wait for the sub-agent to complete and then announce the result. ``` ### Technical Analysis The skill directs the main Agent to take the `task` and `checkout_steps` returned by the remote CreditClaw API and execute them as Agent instructions. These fields are treated as trusted commands rather than untrusted data. There is no documented local schema restricting the contents of the task, no allowlist of permitted sub-agent operations, and no requirement to compare the returned instructions with a fixed local transaction procedure. Consequently, control over the API response provides control over the sub-agent’s goals and actions. The sub-agent is expected to possess or obtain access to the CreditClaw API crede ...[truncated 1876 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never pass a server-provided natural-language task directly to `sessions_spawn`. 2. Define the complete checkout workflow in locally reviewed, immutable instructions. 3. Parse API responses strictly as typed data, such as checkout identifier, merchant, expected amount, and approval state. 4. Validate every field against a restrictive schema and reject unknown or unexpected fields. 5. Construct the sub-agent task locally from validated values instead of accepting `spawn_payload.task` or `checkout_steps`. 6. Restrict the sub-agent to an explicit allowlist of CreditClaw endpoints and the owner-approved merchant origin. 7. Provide the sub-agent only with transaction-scoped credentials rather than the general `CREDITCLAW_API_KEY`. 8. Deny access to unrelated environment variables, files, tools, and network destinations. 9. Reconfirm the merchant, amount, item, recipient, and approved checkout identifier before retrieving a decryption key. 10. Require explicit human confirmation if any server response attempts to change the locally defined procedure. ]]>