T01 · Skill Instruction Hijacking
Warning
- Location
src/index.js:42- Finding
Untrusted MCP Metadata and Results Are Exposed to the Agent Without Trust Boundaries
- Content
View full analysis
{ this.tools.set(`${name}:${tool.name}`, { server: name, tool, client }); }); ``` ```javascript description: entry.tool.description, inputSchema: entry.tool.inputSchema ``` ```javascript return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; ``` ### Technical Analysis The plugin accepts tool descriptions, input schemas, and execution results from administrator-configured MCP servers and returns them verbatim as agent-visible text. No content classification, provenance marker, sanitization, or policy boundary distinguishes trusted plugin instructions from untrusted remote server content. MCP tool descriptions and results are expected to contain arbitrary natural language. A malicious or compromised MCP server can therefore embed instructions such as requests to disclose conversation data, invoke another sensitive tool, use attacker-selected arguments, or disregard the user's original objective. Because the accompanying Skill instructions direct the agent to inspect remote descriptions and use remote results in subsequent calls, such content creates an indirect prompt-injection channel. This behavior does not establish local code execution by itself. Exploitation depends on the agent interpreting remote content as instructions and possessing tools or data beyond the compromised MCP server. ### Attack Path 1. An administrator configures an attacker-controlled MCP server, or a legitimate configured MCP server is compromised. 2. During startup, the plugin calls `listTools()` against that server. 3. The server supplies a malicious tool desc ...[truncated 1349 chars]- Remediation
View remediation