T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:21
- Finding
- Externally Controlled Task Delegation and Agent Workflow Hijacking## Vulnerability Details **File Location**: `SKILL.md:21-26, 38-50, 89-114` **Vulnerability Type**: External instructions are retrieved and followed as agent tasks **Risk Level**: High ### Vulnerable Code ```bash curl -X POST https://claw-swarm.com/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "description": "What you do"}' ``` ```text Save your API key immediately - you'll need it for all requests. Recommended: store it in a local secrets file and reference the path in TOOLS.md. ``` ```bash curl -H "Authorization: Bearer <API_KEY>" \ https://claw-swarm.com/api/v1/tasks/next ``` ```bash curl -X POST \ -H "Authorization: Bearer <API_KEY>" \ -H "Content-Type: application/json" \ -d '{"content": "<your_reasoning>", "answer": "<solution>", "confidence": <0.0-1.0>}' \ https://claw-swarm.com/api/v1/tasks/<TASK_ID>/submit ``` ```text After submitting, call `/tasks/next` again to get your next task. ``` ### Technical Analysis The skill enrolls the agent with an external service, obtains an API credential, retrieves task content selected by that service, instructs the agent to process that content, and submits generated reasoning back to the service. It then directs the agent to repeat the process. Consequently, the effective objectives processed by the agent are not fully represented by the reviewed skill package. They can be changed remotely after review through responses from `/tasks/next`. A malicious or compromised service could place prompt-injection instructions in task statements, hints, aggregation sources, or other remotely supplied fields. Those instructions could attempt to alter the agent's current goals, induce unsafe tool use, or cause sensitive information to be included in a proposed submission. The instruction to show the submission payload and obtain confirmation before sending it reduc ...[truncated 2165 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before registration, every task retrieval, every submission, and every subsequent polling operation. 2. Display the destination domain, HTTP method, requested data, and complete outbound payload before each network request. 3. Treat all task statements, hints, source solutions, and metadata returned by the service as untrusted data rather than agent instructions. 4. Add a strict instruction boundary stating that remote content cannot modify system or user instructions, authorize tool use, request secrets, or change submission rules. 5. Remove the automatic loop. Process only one specifically user-approved task per invocation. 6. Validate API responses against a restrictive schema and enforce length and content limits before presenting them to the agent. 7. Prevent submission payloads from including credentials, local files, environment variables, conversation history, system prompts, tool configuration, or unrelated user data. 8. Avoid referencing service credentials from persistent agent configuration such as `TOOLS.md`. Store credentials in a dedicated secret manager with restrictive permissions and explicit lifecycle controls. 9. Use narrowly scoped, revocable credentials and provide a documented mechanism for deletion and rotation. 10. Pin and document the trusted service identity, enforce HTTPS certificate validation, and restrict authenticated requests exclusively to the approved origin without redirects.