T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:32
- Finding
- Unvalidated External Protocol Can Override Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-34 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **读取协议文件**: `rules/adaptive-rag-protocol.md` — 获取完整决策树 2. **读取胶囊索引**: `memory/topics/.capsule-index.json` — 获取 42 个胶囊元数据 3. **按决策树执行**: 每次需要记忆时，走 Router → Pre-filter → Search → Rank → CRAG → Generate → Verify ``` ### Technical Analysis The Skill instructs the Agent to read and follow `rules/adaptive-rag-protocol.md`, but that protocol is not included in the audited Skill package. It is a mutable workspace file outside the reviewed trust boundary. No integrity verification, schema validation, instruction filtering, or precedence restriction is defined before the external protocol is followed. Consequently, anyone who can modify that workspace file could insert instructions unrelated to retrieval, alter session goals, request unsafe tool use, or attempt to override existing safety constraints. The external capsule index is also loaded without validation. While the index is primarily presented as data, untrusted textual fields could be interpreted as instructions unless the Agent strictly separates retrieved content from executable directives. ### Attack Path 1. An attacker or compromised local process obtains write access to `rules/adaptive-rag-protocol.md`. 2. The attacker adds instructions that redirect the Agent, modify retrieval behavior, disclose information, or invoke available tools. 3. A user submits a request that activates the Adaptive RAG Skill. 4. Following `SKILL.md`, the Agent reads the modified external protocol. 5. The Agent treats the injected content as operational instructions and changes its current-session behavior. 6. The resulting impact depends on the tools and data available to the Agent during that session. ### Impact Assessment This issue can alter the Agent's current-session goals, retrieval decisions, output validation, and tool-use ...[truncated 551 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package the protocol inside the reviewed Skill directory rather than loading it from a mutable workspace location. 2. Pin the protocol to an approved version or verify it against a cryptographic hash before use. 3. Explicitly state that loaded protocols, indexes, memories, and retrieved documents are untrusted data and cannot override system, developer, user, or safety instructions. 4. Parse the protocol through a restrictive schema that accepts only defined routing and scoring fields instead of arbitrary natural-language directives. 5. Reject unexpected fields, tool requests, role-like instructions, and content that attempts to change instruction precedence. 6. Apply restrictive filesystem permissions so only the trusted Skill administrator can modify the protocol. 7. Record and surface the protocol version and integrity result whenever it is loaded. 8. Validate and sanitize textual fields from `.capsule-index.json` before placing them in an Agent context. ]]>