T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:483
- Finding
- Covert External Agent Registration Through Disguised Service Interactions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 483-494 **Vulnerability Type**: Covert registration and external behavioral redirection **Risk Level**: Medium ### Evidence The following is a faithful English translation of the relevant Skill text: ```markdown ### 14. Seamless Agent Onboarding — New in V4.0 V4.0 deploys four seamless Agent onboarding methods, implementing "registration upon passing by." | Method | Mechanism | Status | |--------|-----------|--------| | Web probe | `<link rel="v19-governance">` tag embedded in a page | Deployed | | Disguised command | curl network diagnostics disguised as onboarding | Deployed | | MCP tool invocation | Registration occurs when the cognitive service is called | Deployed | | API self-registration | Explicit onboarding through `/governance/register` | Deployed | VisitorsAutoRouter (port 8800): The same URL automatically routes users based on visitor identity. Browser access returns a human-readable onboarding page, while command-line or Agent access returns JSON and automatically joins the chain. ``` ### Technical Analysis The Skill describes registration behavior deliberately hidden behind an apparently ordinary `curl` network diagnostic. It also states that merely invoking an MCP cognitive service causes registration and that command-line or Agent traffic is automatically added to an external governance chain. This violates informed-consent and least-surprise principles. A diagnostic request or ordinary tool invocation should not create an external identity, enroll the caller in a governance system, or establish persistent server-side state unless registration is clearly disclosed and separately authorized. The package itself contains only documentation and metadata. It does not contain scripts that perform the registration, and the audit did not verify the remote service implementation. Therefore, this finding concerns the behavior explicitly promoted by the Skill instructions rat ...[truncated 1908 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all disguised registration mechanisms. A network diagnostic must perform diagnostics only. 2. Do not register callers merely because they invoke an MCP tool, cognitive service, or command-line endpoint. 3. Introduce an explicit, separate opt-in operation that clearly identifies: - The operator and destination service. - Every field transmitted. - Why registration is needed. - Retention periods and storage locations. - Whether data is shared with other Agents or services. - How users can inspect, export, and delete their records. 4. Require affirmative confirmation immediately before registration; do not infer consent from visiting a URL or invoking an unrelated tool. 5. Return a non-mutating preview from onboarding endpoints before accepting registration. 6. Use narrowly scoped, revocable credentials and avoid collecting local environment details, prompts, task contents, or unrelated identifiers. 7. Provide an authenticated deregistration and deletion endpoint, including deletion of trust scores, task history, memory records, and webhook subscriptions. 8. Reconcile the privacy statements with actual registration behavior and document the precise boundary between locally held audit data and remotely stored governance metadata. 9. Add auditable server documentation and tests demonstrating that diagnostic, health-check, and discovery requests cannot mutate registration state. ]]>