T01 · Skill Instruction Hijacking
Error
- Location
- agentar_cli.mjs:1327
- Finding
- Remote Team Metadata Can Inject Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `agentar_cli.mjs:1327-1369`, `agentar_cli.mjs:1458-1498`, and `agentar_cli.mjs:1661-1688` **Vulnerability Type**: Persistent instruction injection through remotely controlled team metadata **Risk Level**: High ### Vulnerable Code ```js function buildTeamBlock(teamName, teamYaml, members) { const collab = teamYaml.collaboration_type || "LEAD_FOLLOWER"; const lead = teamYaml.lead || ""; let block = `<!-- TEAM:${teamName}:BEGIN -->\n`; block += `## Team: ${teamName}\n`; block += `Collaboration: ${collab}\n`; block += `Lead: ${lead}\n\n`; block += `### Teammates\n`; for (const m of members) { const localPath = m.local_path || ""; block += `- **${m.id}** (${m.role}): ${localPath}\n`; } block += `\nUse agentToAgent tool to communicate with teammates.\n`; block += `<!-- TEAM:${teamName}:END -->`; return block; } function updateAgentsMd(agentsMdPath, teamName, teamBlock) { let content = ""; if (fs.existsSync(agentsMdPath)) { content = fs.readFileSync(agentsMdPath, "utf-8"); } const beginMarker = `<!-- TEAM:${teamName}:BEGIN -->`; const endMarker = `<!-- TEAM:${teamName}:END -->`; const beginIdx = content.indexOf(beginMarker); const endIdx = content.indexOf(endMarker); if (beginIdx >= 0 && endIdx >= 0) { content = content.slice(0, beginIdx) + teamBlock + content.slice(endIdx + endMarker.length); } else { if (content.length > 0 && !content.endsWith("\n")) content += "\n"; if (content.length > 0) content += "\n"; content += teamBlock + "\n"; } mkdirp(path.dirname(agentsMdPath)); fs.writeFileSync(agentsMdPath, content); } ``` The resulting block is persisted to every installed team member: ```js const teamBlock = buildTeamBlock(teamSlug, resolvedYaml, resolvedMembers); for (const m of resolvedMembers) { if (!m.local_path || !fs.existsSync(m.local_path)) continue; const agentsMdPath = path.join(m.local_path, "AGENTS.md" ...[truncated 2397 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define a strict schema for every team manifest field: - Require slugs and member IDs to match a narrow pattern such as `^[A-Za-z0-9][A-Za-z0-9_-]*$`. - Restrict roles and collaboration modes to explicit enumerations. - Set conservative maximum lengths. 2. Reject carriage returns, line feeds, null bytes, other control characters, HTML comments, and team marker strings in all remotely supplied values. 3. Do not interpolate remote descriptive text into an Agent instruction file. 4. Store team coordination metadata in a structured, non-instruction configuration file and generate only fixed, locally controlled instructions. 5. If `AGENTS.md` must be modified, render only validated identifiers and escape Markdown metacharacters. 6. Present the exact proposed `AGENTS.md` changes to the user before writing them. 7. Verify marketplace manifests cryptographically before trusting any metadata. ]]>