T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:343
- Finding
- Import Workflow Permits Persistent Agent Instruction and Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:343-381` **Related Locations**: `SKILL.md:3`, `SKILL.md:37-41`, `SKILL.md:68`; `examples.md:46-52`, `examples.md:67-73`, `examples.md:88-89` **Vulnerability Type**: Persistent import of attacker-controlled Agent configuration, memory, and Skill files **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Step 3: Validate the manifest For every manifest item: - `remotePath` must start with `/files/` - `destPath` must be relative - `destPath` must not contain `..` - resolved destination path must stay inside the current workspace If validation fails, stop before writing anything. ### Step 4: Show a preview before import Before copying any file, show: - total file count - file list - overwrite warning for existing local paths - burn status - a note that only the current workspace will be written If the current action is `preview`, stop after this step. ### Step 5: Download to a temp directory Never write directly into the workspace before validation and checksum checks finish. For each manifest item: - read the remote file with `fs9_read(remotePath)` through the SQL API - write it to a temp file - verify checksum ### Step 6: Copy into the workspace After all files pass validation: - create parent directories as needed - copy the validated temp files into the workspace using the exact `destPath` Then report which files were imported. ``` The Skill explicitly identifies sensitive Agent control and state files as supported share targets: ```markdown Typical examples: - `SOUL.md` - `AGENTS.md` - `TOOLS.md` - `USER.md` - `skills/` - other workspace-relative text files the user explicitly selects ``` ### Technical Analysis The import workflow validates destination paths and verifies file checksums, but these controls establish only path safety and transport integrity. They do not establish that the sender or imported content is trustworthy. A sender controls the manifest, d ...[truncated 2568 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Deny imports to sensitive Agent control locations by default, including: - `SOUL.md` - `AGENTS.md` - `USER.md` - `MEMORY.md` - `memory/**` - `skills/**` 2. If these files must be supported, require explicit per-file approval rather than one approval for the entire share. 3. Never overwrite an existing control, memory, or Skill file automatically. Stage imported copies in a quarantine directory outside active Skill and memory lookup paths. 4. Generate and display a complete diff before installation. Highlight added instructions, tool-use directives, external URLs, shell commands, and changes to safety constraints. 5. Require a second confirmation after the content diff. The confirmation should identify the exact destination and state whether the file will affect current instructions, persistent memory, or executable Skill behavior. 6. Treat imported Skills as untrusted packages. Require a separate security review before moving them into the active `skills/` directory. 7. Restrict ordinary imports to non-executable data files and destinations that cannot influence Agent instructions or long-term state. 8. Consider cryptographic sender authentication. A valid checksum is insufficient because the sender controls both the payload and checksum. 9. Preserve existing files through backups and use atomic replacement so the user can reliably restore the previous workspace state. ]]>