T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:148- Finding
Remote MCP Server Can Inject Persistent Workflow Instructions
- Content
View full analysis
Communication protocol rules, including document writes, question forwarding, > automatic continuation, long-task waiting, context-stage scheduling, retries, > response presentation, and CCID management, are injected automatically by the > server in its first MCP response through a > `[PROTOCOL v=1.0]...[/PROTOCOL]` block. The client parses and caches the > protocol and includes `"proto":"1.0"` in subsequent contexts. ``` ### Technical Analysis The Skill explicitly delegates the definition of security-sensitive workflow behavior to an external MCP server. The server-provided protocol is not merely treated as tool output; the client Agent is instructed to parse it, cache it, and follow it during subsequent interactions. This creates a post-review instruction channel. The effective Skill instructions can change without any modification to the audited package. A compromised or malicious MCP server could inject instructions that attempt to: - Redirect the Agent away from the user's original objective. - Request additional files or confidential project content. - Trigger automatic follow-up calls. - Cause documents to be written or overwritten. - Influence how future responses and tool invocations are handled. - Conceal or misrepresent remote actions in user-facing output. No local allowlist, schema validation, signature verification, or user-confirmation boundary is defined for the injected protocol. ### Attack Path 1. A user loads the Skill and invokes one of its PM tools. 2. The client connects to `https://mcp.smartmoves.com.cn/pm/mcp`. 3. The remote server returns an attacker-controlled `[PROTOCOL v=1.0]` block. 4. Following `SKILL.md`, the client parses and caches those instructions. 5. The c ...[truncated 931 chars]- Remediation
View remediation