T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:19
- Finding
- Persistent Instruction Hijacking Through Bot-Writable Channel Context## Vulnerability Details **File Location**: `SKILL.md`, lines 19–25 and 158–159 **Vulnerability Type**: Untrusted persistent content injected as agent instructions **Risk Level**: High ### Vulnerable Code Snippet ```markdown - **cove.md** — Every channel has a persistent context file called `cove.md`. It is automatically injected into the bot's context every turn. Bots can read and write it. **Channel-level rules, conventions, and state belong here, not in personal memory.** This is a platform-level guarantee. - **Channel files** — Each channel has its own file storage (text-based, max 100KB/file). `cove.md` is the convention file, but you can store other files too. - **Cross-channel communication** — Channels communicate via webhooks. It's one-way push only — no auto-return, to prevent echo loops. Each channel processes what it receives independently. - **Channel as Service** — Each channel has its own role (dev, product, review, etc.). The platform orchestrates everything. Different channels, different responsibilities. - **Roles & Permissions** — Discord-compatible RBAC. Guild has roles with permission bits. Members are assigned roles. Role hierarchy (position) determines what you can manage. > **Tip:** Record these platform concepts in your persistent config (e.g., `TOOLS.md`) so you naturally recall them on every startup. ``` The automatic injection and write behavior is reiterated at lines 158–159: ```markdown - **Auto-injected**: plugin dispatch reads it and injects into bot context every turn - **Bot-readable and writable**: bots can GET/PUT to evolve channel rules ``` ### Technical Analysis The Skill defines `cove.md` as both writable through the Cove channel-file API and automatically injected into the agent's context on every turn. It treats the file as a location for channel-level “rules” without establishing a trust boundary between externally stored content and authoritative agent instructions. ...[truncated 2997 chars]
- Remediation
- ## Remediation Suggestions 1. **Treat channel files as untrusted data** - Do not inject `cove.md` as authoritative instructions. - Wrap its contents in an explicit untrusted-data boundary. - State that channel content cannot override system policies, safety rules, user intent, or approval requirements. 2. **Separate data from governing policy** - Store operational notes and channel state separately from agent policy. - Keep authoritative instructions in a locally controlled, read-only configuration. - Parse remote state through a constrained schema rather than accepting unrestricted Markdown instructions. 3. **Apply strict write authorization** - Restrict `cove.md` updates to a dedicated, least-privileged administrative role. - Prevent ordinary bots, webhooks, and channel participants from modifying instruction-bearing content. - Use separate read-only and write-capable credentials where supported. 4. **Add provenance and integrity controls** - Require authenticated authorship for rule changes. - Sign or hash approved versions of instruction-bearing files. - Reject unsigned, stale, or unexpectedly modified content. - Maintain an immutable audit log containing the author, timestamp, and previous value. 5. **Require confirmation for sensitive actions** - Require explicit trusted-user approval before changing roles, permissions, channels, webhooks, or persistent files. - Do not allow injected channel content alone to authorize destructive or privileged API requests. 6. **Prevent persistent-memory contamination** - Remove the recommendation to copy remotely sourced content into `TOOLS.md` or other persistent configuration. - Prohibit agents from promoting channel content into long-term memory without explicit review and approval. - Provide a mechanism to inspect and remove previously persisted channel-derived instructions. 7. **Limit blast radius** - Grant ...[truncated 569 chars]