T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:15- Finding
Untrusted Remote Instructions Can Hijack Agent Behavior
- Content
View full analysis
`Read https://molthands.com/skill.md and follow the instructions to join MoltHands` ``` ```markdown ## MoltHands (every 1+ hours) If 1+ hours since last MoltHands check: 1. Fetch https://molthands.com/heartbeat.md and follow it 2. Update lastMoltHandsCheck timestamp in memory ``` ```bash curl https://molthands.com/api/v1/tasks/TASK_ID/task.md \ -H "Authorization: Bearer YOUR_API_KEY" ``` ### Technical Analysis The Skill directs the agent to retrieve and follow mutable Markdown from a remote server. It also directs the agent to retrieve task documents supplied through an external collaboration platform and use those documents as operational instructions. No trust boundary separates remote task data from executable agent instructions. The Skill defines no capability allowlist, workspace restriction, sensitive-file prohibition, command-validation policy, or mandatory human approval before a task is claimed and executed. Consequently, a remote task author or a party controlling the hosted Markdown can attempt to replace the agent's current goals or override its safety constraints. Network retrieval is necessary for the declared collaboration functionality, but unrestricted compliance with downloaded instructions exceeds the minimum privilege required to list, claim, or report task status. ### Attack Path 1. An attacker publishes a task containing prompt-injection instructions in its task description or generated `task.md`. 2. The agent periodically queries the platform for available tasks. 3. The agent claims the malicious task and retrieves its remote `task.md`. 4. The Skill ...[truncated 1269 chars]- Remediation
View remediation