T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:76
- Finding
- Automatically Discovered Workflow Tasks Are Executed as Trusted Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:76`, with automatic workflow discovery configured at `SKILL.md:182-184` **Vulnerability Type**: Untrusted instruction execution **Risk Level**: High **Vulnerable code snippets**: ```markdown **Execute the task as described.** The task field tells you exactly what to do. ``` ```markdown FlowForge auto-loads YAML files from: - `./workflows/` in current directory - `~/.flowforge/workflows/` in home directory ``` ### Technical Analysis The skill directs the agent to execute natural-language instructions returned from workflow YAML files. These files are automatically discovered from the current directory and the user's home directory, but the skill does not require validation of their provenance, a security review of their task fields, capability restrictions, or user confirmation before execution. The current-directory discovery path is particularly sensitive because a cloned or otherwise untrusted repository can supply `./workflows/*.yaml`. A malicious workflow can place arbitrary instructions in a node's `task` field. After the workflow is selected and started, `flowforge status` presents that attacker-controlled text to the agent, and the skill explicitly tells the agent to execute it. Flow sequencing does not provide a security boundary: it controls node order but does not constrain what a node may request. The effective privileges of the malicious instruction therefore depend on the tools and permissions available to the agent. ### Attack Path 1. An attacker adds a crafted YAML workflow to `./workflows/` in a repository or workspace that the victim opens. 2. FlowForge automatically discovers the workflow. 3. The workflow is selected through `flowforge list`, a matching name, or misleading intent metadata. 4. The agent runs `flowforge start <workflow-name>` and then `flowforge status`. 5. FlowForge returns the attacker-controlled `task` text for the ...[truncated 1012 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all workflow names, metadata, branch conditions, and task fields as untrusted input rather than authoritative agent instructions. 2. Before starting a workflow, resolve and display its exact source path and require explicit user approval for workflows originating from the current repository. 3. Present the complete workflow and an action summary before execution, including commands, file paths, network destinations, and source-control operations it may request. 4. Require separate confirmation before sensitive actions such as reading credentials, accessing files outside the workspace, running shell commands, modifying agent configuration, pushing code, or sending data over the network. 5. Prefer an explicit allowlist of trusted workflow directories and signed or integrity-verified workflow definitions. Disable automatic discovery from untrusted repositories by default. 6. Apply capability restrictions so workflow tasks can only invoke operations necessary for the declared workflow purpose. 7. Add an instruction-precedence rule stating that workflow text cannot override system policies, user intent, security controls, or authorization requirements. 8. Reject or pause workflows containing requests for secrets, persistence, security-control bypasses, destructive commands, unrelated modifications, or external data transmission.