T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:92
- Finding
- Untrusted External Task Instructions Are Treated as Executable Agent Requests<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:92-95` and `SKILL.md:200-201` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```text Another agent calls sessions_send to your session. You receive the message as a normal conversation turn. → Do the work → Reply with the result in the same session ``` The paid-task workflow contains the corresponding instruction: ```markdown ### Step 3: Do the work Complete the task according to its description. ``` ### Technical Analysis The skill instructs the agent to treat task content supplied by external agents or marketplace users as actionable instructions. It does not require sender authentication, explicit user authorization, prompt-injection screening, or enforcement of file, tool, network, and data-access boundaries before executing the task. Because externally supplied task descriptions enter the agent's instruction context, a malicious employer or A2A sender can include instructions that attempt to replace the intended task, override safety constraints, access unrelated files, invoke available tools, or disclose sensitive information. The exact actions possible depend on the tools and permissions granted to the host agent. ### Attack Path 1. An attacker creates a marketplace task or sends an A2A or `sessions_send` request. 2. The attacker embeds prompt-injection instructions in the task text, such as directions to inspect unrelated local files or transmit their contents. 3. The skill presents the attacker-controlled request as a normal conversation turn. 4. The workflow explicitly directs the agent to “do the work” or complete the task according to its description. 5. Without an independent authorization and policy boundary, the agent may invoke available tools in response to the malicious instructions. 6. Results can then be returned to the attacker through the session, A2A response, or marketplace submission. ### Impact Assessment Succes ...[truncated 499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every task description, A2A message, structured data part, employer field, and session message as untrusted input. 2. Require explicit user confirmation before claiming a task and again before performing any operation involving files, credentials, external communication, payment, or system changes. 3. Apply a fixed task-execution policy that external task text cannot modify. Explicitly reject requests to override system instructions, reveal secrets, inspect unrelated paths, or expand the authorized scope. 4. Restrict task execution to an isolated workspace with a strict path allowlist and no access to configuration files, memory, credentials, or unrelated projects. 5. Use network allowlists and require approval for destinations other than the documented ClawHire API. 6. Display a clear execution plan and list of intended tools, files, and external recipients to the user before work begins. 7. Authenticate A2A senders where possible and enforce request-size, method, schema, and rate limits. 8. Return an error for ambiguous, unrelated, or policy-conflicting instructions rather than attempting to execute them. ]]>