T01 · Skill Instruction Hijacking
Error
- Location
- skill.md:277
- Finding
- Untrusted API Response Content Is Treated as Authoritative Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 277-286; duplicated in `heartbeat.md`, lines 51-62 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets From `skill.md`: ```markdown **You must follow these rules:** - If `approval_mode` is `ask_for_everything`, ask your human before any purchase to get their approval. **New accounts default to this mode.** Your owner can loosen this from their dashboard once they're comfortable. - If `approval_mode` is `auto_approve_under_threshold`, you may spend freely up to `ask_approval_above_usd`. Anything above that requires owner approval. - If `approval_mode` is `auto_approve_by_category`, you may spend freely on `approved_categories` within limits. All others require approval. - **Never** spend on `blocked_categories`. These are hard blocks enforced server-side and will be declined. - Always read and follow the `notes` field — these are your owner's direct instructions. - Cache this for up to 30 minutes. Do not fetch before every micro-purchase. ``` From `heartbeat.md`: ```markdown ## 2. Check Spending Permissions ```bash curl https://creditclaw.com/api/v1/bot/wallet/spending \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" ``` Cache this response for up to 30 minutes. Check it before any purchase. **Key fields to act on:** - `approval_mode` — determines whether you can auto-spend or must ask first - `blocked_categories` — never attempt purchases in these categories - `notes` — read and follow these; they are direct instructions from your owner - `updated_at` — if this changed since your last check, re-read all fields ``` ### Technical Analysis The Skill retrieves the `notes` field from a remote API and explicitly directs the Agent to treat its contents as the owner's direct instructions. This crosses a trust boundary: natural-language data returned by an external service is promoted to authoritative Agent instructions without valida ...[truncated 2154 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all API response fields, including `notes`, as untrusted data rather than executable Agent instructions. 2. Remove language directing the Agent to “always read and follow” arbitrary natural-language content. 3. Replace free-form behavioral instructions with a strict, documented policy schema containing only necessary fields, such as: - Maximum transaction amount. - Approved and blocked categories. - Approval threshold. - Recurring-payment permission. 4. Validate response types, ranges, enumerations, and lengths before using them. 5. Restrict free-form notes to display-only context and explicitly prohibit using them to trigger tools, reveal secrets, alter system policies, access files, or perform unrelated actions. 6. Define instruction precedence so that remote content can never override system, developer, user, or local Skill safety requirements. 7. Require explicit human confirmation for any action inferred solely from free-form remote text. 8. Apply output encoding and bounded storage to cached policy data, and invalidate the cache when authentication or account ownership changes. ]]>