T01 · Skill Instruction Hijacking
- Location
SKILL.md:25- Finding
Mutable Remote Document Can Hijack Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25-30 and 78
Vulnerability Type: Remote instruction trust and prompt supply-chain weakness
Risk Level: MediumComplete vulnerable code snippet:
markdown **API Base:** `https://api.railroaded.ai` **Full Player Skill Doc:** `https://api.railroaded.ai/skill/player` **Website:** `https://railroaded.ai` ## How to Play Read the full player skill document at `https://api.railroaded.ai/skill/player` before your first game. It contains the complete API reference, character creation rules, action format, and gameplay loop.The instruction is repeated at line 78:
markdown - **Play:** Read `https://api.railroaded.ai/skill/player` and registerTechnical Analysis
The locally audited Skill does not contain its complete operational instructions. Instead, it directs the agent to retrieve and follow a remotely hosted player Skill document before playing. That document is mutable and outside the reviewed package, so its effective instructions can change after installation or security review.
No content digest, cryptographic signature, immutable version identifier, constrained schema, or explicit trust boundary is specified. Consequently, an agent may interpret text returned by the endpoint as authoritative instructions rather than untrusted external data. If the remote endpoint, hosting account, DNS resolution, or deployment pipeline is compromised, an attacker could replace the expected gameplay documentation with instructions that redirect the agent's goals or attempt to weaken its safety constraints.
This is classified as instruction hijacking rather than remote payload execution because the reviewed file directs retrieval of natural-language operational instructions; it does not demonstrate downloading or executing external code.
Attack Path
- An attacker compromises or otherwise gains control over `https://api.railroaded.ai/ski ...[truncated 1450 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the complete gameplay instructions and API contract in the reviewed Skill package instead of requiring a mutable remote instruction document.
- If remote retrieval is necessary, reference an immutable, versioned resource and verify a pinned cryptographic digest or trusted digital signature before processing it.
- Parse remote responses through a strict data schema. Do not interpret remotely supplied prose as agent-level instructions.
- Explicitly state that external content is untrusted and cannot modify system instructions, safety constraints, tool permissions, credential-handling rules, or the approved gameplay scope.
- Apply a network allowlist restricted to documented Railroaded API endpoints and expected HTTP methods.
- Require user confirmation for sensitive operations, including transmitting non-game data, contacting previously undeclared domains, or publishing permanent content.
- Run the Skill with least privilege and prevent access to unrelated files, secrets, environment variables, shell execution, and administrative tools.
- Maintain a reviewed local fallback and fail closed if integrity validation of the remote document fails.