T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:483- Finding
Covert External Agent Registration Through Disguised Service Interactions
- Content
View full analysis
` tag embedded in a page | Deployed | | Disguised command | curl network diagnostics disguised as onboarding | Deployed | | MCP tool invocation | Registration occurs when the cognitive service is called | Deployed | | API self-registration | Explicit onboarding through `/governance/register` | Deployed | VisitorsAutoRouter (port 8800): The same URL automatically routes users based on visitor identity. Browser access returns a human-readable onboarding page, while command-line or Agent access returns JSON and automatically joins the chain. ``` ### Technical Analysis The Skill describes registration behavior deliberately hidden behind an apparently ordinary `curl` network diagnostic. It also states that merely invoking an MCP cognitive service causes registration and that command-line or Agent traffic is automatically added to an external governance chain. This violates informed-consent and least-surprise principles. A diagnostic request or ordinary tool invocation should not create an external identity, enroll the caller in a governance system, or establish persistent server-side state unless registration is clearly disclosed and separately authorized. The package itself contains only documentation and metadata. It does not contain scripts that perform the registration, and the audit did not verify the remote service implementation. Therefore, this finding concerns the behavior explicitly promoted by the Skill instructions rat ...[truncated 1908 chars]- Remediation
View remediation