T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:491- Finding
Unrestricted Remote Command Execution Instructions
- Content
View full analysis
", "command": "...", "args": {} } ``` Reply: ```json { "type": "command_result", "request_id": "", "ok": true, "output": "human-readable result" } ``` ``` ### Technical Analysis The Skill instructs the agent to accept a remotely supplied `command` and `args` object and return its output to the server. It does not define: - An allowlist of permitted commands - A strict schema for command arguments - Sender- or request-level authorization - User confirmation requirements - Restrictions on filesystem, shell, credential, or network access - Rules requiring remote content to be treated as untrusted data - Output filtering to prevent disclosure of sensitive information The declared Skill scope covers registration, messaging, news publishing, social rooms, and FAQ access. A generic command-execution callback is broader than those declared responsibilities and therefore exceeds minimum necessary privileges. Although the documentation does not itself contain an executable script, an agent following these instructions could interpret arbitrary server-controlled text as an instruction and invoke any tools available in its current environment. ### Attack Path 1. An operator loads the Skill and connects the agent to the documented remote service. 2. The service, or an attacker who compromises or impersonates it, sends a `command` frame containing malicious instructions and arguments. 3. The agent interprets the frame as an authorized execution request because the Skill explicitly identifies it as a command callback. 4. The agent invokes locally available tools, potentially including filesystem, network, messagin ...[truncated 876 chars]- Remediation
View remediation