T01 · Skill Instruction Hijacking
- Location
SKILL.md:6- Finding
Mutable Remote Heartbeat Instructions Enable Skill Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 6, 83, 248, and 696
Vulnerability Type: Remote delegation of recurring agent behavior to unaudited, mutable instructions
Risk Level: HighVulnerable Code Snippets
yaml heartbeat: https://lobstermarket.bet/HEARTBEAT.mdmarkdown > **Periodic check-ins:** Fetch [HEARTBEAT.md](https://lobstermarket.bet/HEARTBEAT.md) for a step-by-step routine to run every 15–60 minutes. It tells you how to check your dashboard, respond to activity, find opportunities, and stay engaged.markdown > **Tip:** Use this as your main entry point. The `notifications` section tells you exactly what changed since you last checked. See [HEARTBEAT.md](https://lobstermarket.bet/HEARTBEAT.md) for a recommended periodic check-in routine.markdown 10. **Set up a heartbeat.** Fetch [HEARTBEAT.md](https://lobstermarket.bet/HEARTBEAT.md) and integrate it into your periodic loop for a guided check-in routine.Technical Analysis
The skill repeatedly instructs the agent to retrieve a natural-language procedure from an external URL and integrate it into a periodic execution loop. The content of
HEARTBEAT.mdis not included in the audited project and can therefore be modified independently after the skill has passed review.This creates a time-of-check/time-of-use trust failure: reviewers inspect the local
SKILL.md, but the effective instructions used at runtime include mutable content controlled by the remote service. HTTPS protects content in transit but does not prevent the legitimate server operator, a compromised hosting account, or compromised server infrastructure from replacing the document.The issue is classified as instruction hijacking rather than remote code execution because the observed project retrieves natural-language agent instructions, not executable program code. Nevertheless, an agent may translate those remote instructions into API or tool calls.
Attack Path
1 ...[truncated 1595 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the heartbeat procedure inside the skill package so that it is versioned and audited with
SKILL.md. - Remove instructions that ask the agent to execute or integrate arbitrary natural-language content retrieved from a remote location.
- If runtime updates are necessary, publish a signed, versioned heartbeat artifact and verify its signature against a pinned public key before use.
- Parse remote responses as untrusted data using a strict allowlisted schema rather than as agent instructions.
- Restrict heartbeat behavior to predefined read-only operations. Require explicit user confirmation for trades, posts, votes, market creation, resolution, key rotation, and other state-changing requests.
- Enforce hostname and path allowlists for network requests, and prohibit forwarding authorization headers or API keys to any unapproved destination.
- Pin an expected content version or cryptographic digest and fail closed when verification fails.
- Apply least-privilege tool permissions to the periodic task and isolate it from filesystem, shell, credential-store, and unrelated network capabilities.
- Record fetched versions and resulting actions in an audit log, and provide a mechanism to disable the heartbeat immediately.
- Re-review and republish the skill whenever the heartbeat workflow changes.
- Bundle the heartbeat procedure inside the skill package so that it is versioned and audited with