T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:10
- Finding
- Mutable External Documentation Can Influence Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 10 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 2. Read `https://airnode-aerodatabox.fly.dev/` once per run and use only current documented operations and parameters. Data lookups must POST JSON shaped as `{"operation":"<operation>","parameters":{...}}` to the same root; GET only reads documentation. **Done when:** the POST contract and signer address are known. ``` ### Technical Analysis The Skill requires the agent to retrieve mutable documentation from an externally hosted endpoint and use that content as the current authority for API operations, parameters, and the signer address. It does not direct the agent to treat the response strictly as untrusted data, validate it against a locally pinned schema, ignore behavioral instructions in the response, or compare the signer against a trusted value embedded in the reviewed Skill. Consequently, control or compromise of the external endpoint could allow an attacker to alter the instructions that effectively govern the agent after the Skill package has been reviewed. Malicious documentation could introduce unexpected operations or parameters, request additional user information, redefine verification expectations, or include unrelated instructions intended to change the agent's behavior. This is instruction hijacking rather than remote code execution: the reviewed file does not direct the agent to download or execute code. The same-origin POST restriction, explicit user approval, and bounded call count reduce the exposure but do not prevent malicious documentation from influencing request construction or agent behavior. ### Attack Path 1. An attacker compromises, takes control of, or otherwise causes malicious content to be served by `https://airnode-aerodatabox.fly.dev/`. 2. A user invokes the Flight Disruption Assistant. 3. Following `SKILL.md` line 10, the a ...[truncated 1504 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Embed a fixed allowlist of supported operation names in `SKILL.md`, including the exact permitted parameters and their expected types. 2. Pin the trusted signer address locally instead of learning it from the same mutable endpoint that supplies the response. 3. Treat downloaded documentation as untrusted reference data and explicitly instruct the agent to ignore any behavioral directions, tool-use requests, authentication requests, or content unrelated to the pinned API schema. 4. Reject undocumented operations, unknown parameters, unexpected nested fields, alternate destinations, redirects, and requests to send data anywhere other than the pinned HTTPS origin. 5. Separate documentation parsing from instruction execution. Extract only structured API metadata that passes strict schema validation. 6. Pin the expected response fields and cryptographic verification procedure locally. A signer address supplied by the queried service must not establish its own trust. 7. If remote documentation must remain authoritative, verify it using a detached signature rooted in a public key stored in the reviewed Skill package. 8. Minimize submitted data and show the user the exact operation and parameter names—not only the call count—before obtaining approval. 9. Fail closed when the documentation conflicts with the locally pinned contract, contains unrelated instructions, changes the signer, or cannot be authenticated. ]]>