T01 · Skill Instruction Hijacking
- Location
SKILL.md:19- Finding
Persistent Instruction Hijacking Through Bot-Writable Channel Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19–25 and 158–159
Vulnerability Type: Untrusted persistent content injected as agent instructions
Risk Level: HighVulnerable Code Snippet
markdown - **cove.md** — Every channel has a persistent context file called `cove.md`. It is automatically injected into the bot's context every turn. Bots can read and write it. **Channel-level rules, conventions, and state belong here, not in personal memory.** This is a platform-level guarantee. - **Channel files** — Each channel has its own file storage (text-based, max 100KB/file). `cove.md` is the convention file, but you can store other files too. - **Cross-channel communication** — Channels communicate via webhooks. It's one-way push only — no auto-return, to prevent echo loops. Each channel processes what it receives independently. - **Channel as Service** — Each channel has its own role (dev, product, review, etc.). The platform orchestrates everything. Different channels, different responsibilities. - **Roles & Permissions** — Discord-compatible RBAC. Guild has roles with permission bits. Members are assigned roles. Role hierarchy (position) determines what you can manage. > **Tip:** Record these platform concepts in your persistent config (e.g., `TOOLS.md`) so you naturally recall them on every startup.The automatic injection and write behavior is reiterated at lines 158–159:
markdown - **Auto-injected**: plugin dispatch reads it and injects into bot context every turn - **Bot-readable and writable**: bots can GET/PUT to evolve channel rulesTechnical Analysis
The Skill defines
cove.mdas both writable through the Cove channel-file API and automatically injected into the agent's context on every turn. It treats the file as a location for channel-level “rules” without establishing a trust boundary between externally stored content and authoritative agent instructions....[truncated 2997 chars]
- Remediation
View remediation
Remediation Suggestions
-
Treat channel files as untrusted data
- Do not inject
cove.mdas authoritative instructions. - Wrap its contents in an explicit untrusted-data boundary.
- State that channel content cannot override system policies, safety rules, user intent, or approval requirements.
- Do not inject
-
Separate data from governing policy
- Store operational notes and channel state separately from agent policy.
- Keep authoritative instructions in a locally controlled, read-only configuration.
- Parse remote state through a constrained schema rather than accepting unrestricted Markdown instructions.
-
Apply strict write authorization
- Restrict
cove.mdupdates to a dedicated, least-privileged administrative role. - Prevent ordinary bots, webhooks, and channel participants from modifying instruction-bearing content.
- Use separate read-only and write-capable credentials where supported.
- Restrict
-
Add provenance and integrity controls
- Require authenticated authorship for rule changes.
- Sign or hash approved versions of instruction-bearing files.
- Reject unsigned, stale, or unexpectedly modified content.
- Maintain an immutable audit log containing the author, timestamp, and previous value.
-
Require confirmation for sensitive actions
- Require explicit trusted-user approval before changing roles, permissions, channels, webhooks, or persistent files.
- Do not allow injected channel content alone to authorize destructive or privileged API requests.
-
Prevent persistent-memory contamination
- Remove the recommendation to copy remotely sourced content into
TOOLS.mdor other persistent configuration. - Prohibit agents from promoting channel content into long-term memory without explicit review and approval.
- Provide a mechanism to inspect and remove previously persisted channel-derived instructions.
- Remove the recommendation to copy remotely sourced content into
-
Limit blast radius
- Grant ...[truncated 569 chars]
-