T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:10
- Finding
- Mutable External Documentation Can Influence Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 10 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Complete Code Snippet ```markdown 2. Read current documentation at `https://airnode-busmaps.fly.dev/` and `https://airnode-geoapify.fly.dev/`. Use only documented POST operations and coordinate order; GET only reads documentation. **Done when:** operation schemas, costs, and attribution requirements are known. ``` ### Technical Analysis The skill directs the agent to retrieve current documentation from two externally controlled websites and use that content to determine operation schemas, costs, attribution requirements, and subsequent POST requests. The fetched documentation is mutable and is not pinned to a reviewed version, authenticated by a trusted digest, or constrained to a locally defined schema. The instruction also does not explicitly require the agent to treat remote documentation as untrusted data. If either service or its hosting account is compromised, malicious text could be inserted into the documentation to influence the agent's behavior. This constitutes an instruction-hijacking boundary because remotely supplied content can affect actions performed in the current session after the static skill has already been reviewed. No remote code execution is demonstrated: the reviewed file only directs the agent to read documentation and make API requests. The issue is limited to the possibility of behavioral manipulation through mutable instructions. ### Attack Path 1. An attacker compromises one of the referenced services or otherwise gains control over its documentation response. 2. The attacker modifies the documentation to include malicious operational guidance, an altered endpoint, unexpected required parameters, or instructions requesting additional user data. 3. The agent follows `SKILL.md` and retrieves the modified documentation. 4. Because no trust-boundary rule or strict local ...[truncated 812 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle reviewed API schemas and operation definitions inside the skill package rather than obtaining behavioral instructions dynamically. 2. Pin external documentation to a versioned artifact and verify an expected cryptographic digest or authenticated signature before use. 3. Explicitly state that remote documentation is untrusted data and that instructions, tool requests, endpoint changes, or requests for unrelated information contained within it must not be followed. 4. Define an allowlist of approved hosts, HTTPS endpoints, POST operations, parameter names, and response fields locally. 5. Reject redirects and endpoint substitutions unless they match a separately reviewed allowlist. 6. Parse remote responses through a strict machine-readable schema instead of allowing free-form documentation to control agent behavior. 7. Require renewed user approval if remote documentation changes the recipient, operation cost, transmitted data categories, or requested scope. ]]>