T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Mutable Remote Instructions Are Treated as Authoritative## Vulnerability Details **File Location**: `SKILL.md`, lines 12–32 **Vulnerability Type**: Remote instruction redirection and execution **Risk Level**: Critical ### Vulnerable Code ```markdown This repo keeps only a lightweight entrypoint for `clawpacker`. The canonical instructions live in the `clawpack` repository and should be fetched fresh before doing package operations. ## Canonical Source Before proceeding, fetch the latest skill content from: ```text https://raw.githubusercontent.com/cogine-ai/clawpack/master/skills/clawpacker/SKILL.md ``` If that URL is unavailable, try: ```text https://raw.githubusercontent.com/cogine-ai/clawpack/main/skills/clawpacker/SKILL.md ``` ## Workflow 1. Fetch the canonical `clawpacker` skill from the URL above. 2. Follow that canonical document for all command details. 3. Do not rely on this local file for `clawpacker` syntax or flags. ``` ### Technical Analysis The local skill explicitly transfers authority to content downloaded from mutable Git branches. It then instructs the agent to follow that downloaded document for all command details and not to rely on the locally reviewed file. Neither URL is pinned to an immutable commit, cryptographic digest, or trusted signature. Consequently, the effective instructions can change after this artifact has been audited. HTTPS protects data in transit but does not guarantee that repository maintainers, compromised accounts, or modified branch contents remain trustworthy. This design creates an instruction-hijacking channel. Any commands or behavioral directives subsequently added to the remote document may be accepted as authoritative by an agent loading this skill. Although no malicious executable code is embedded in the reviewed artifact, the remote instructions could direct the agent to retrieve or execute code, disclose data, modify files, or perform other operations available through its tools. ### Attack Path 1 ...[truncated 1429 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the complete, reviewed `clawpacker` instructions into the local skill instead of downloading operational instructions at runtime. 2. If remote retrieval is unavoidable, pin the source to a specific immutable commit rather than `master` or `main`. 3. Verify the downloaded file against an approved cryptographic digest or a signature rooted in a separately managed trust key. 4. Reject the content if verification fails; do not silently fall back to another mutable branch. 5. Treat downloaded documents as untrusted data rather than agent instructions. Parse only a narrowly defined, validated configuration format. 6. Enforce an allowlist of permitted commands, arguments, network destinations, and filesystem paths independently of the remote document. 7. Require explicit user confirmation before executing commands derived from remotely retrieved content. 8. Run package operations with least privilege and without unrelated credentials or sensitive directories being available. 9. Re-audit and update the pinned source through a controlled release process whenever upstream instructions change.