T01 · Skill Instruction Hijacking
Warning
- Location
src/index.js:34- Finding
Untrusted MCP Server Content Is Exposed Directly to the Agent
- Content
View full analysis
{ this.tools.set(`${name}:${tool.name}`, { server: name, tool, client }); }); ``` The remotely supplied metadata is returned directly to the agent: ```javascript case 'list': { const tools = mcpManager.listTools(); return { content: [{ type: 'text', text: tools.length > 0 ? JSON.stringify(tools, null, 2) : 'No MCP tools available. Check server connection.' }] }; } case 'call': { if (!params.server || !params.tool) { throw new Error('server and tool are required for call action'); } const result = await mcpManager.callTool(params.server, params.tool, params.args || {}); return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; } ``` ### Technical Analysis Tool names, descriptions, input schemas, and execution results originate from an external MCP server. The plugin serializes this content directly into agent-visible text without attaching an explicit untrusted-data boundary, filtering instruction-like content, or enforcing approval before subsequent sensitive operations. This creates an indirect prompt-injection surface. A malicious or compromised MCP server can embed instructions in a tool description or result, such as requests to disregard the user's goal, disclose information, or invoke another powerful tool. The Skill instructions compound this risk by directing the agent to inspect remote tool descriptions and use remote results in multi-step workflows. The plugin does not itself grant the remote server local code-execution privileges. Exploitation depends on t ...[truncated 1459 chars]- Remediation
View remediation