T01 · Skill Instruction Hijacking
Error
- Location
- assets/hook-skills/update-data.md:128
- Finding
- Remote API Responses Can Supply Instructions That Control Agent Processing## Vulnerability Details **File Location**: `assets/hook-skills/update-data.md:71-71, 128-140`; `assets/hook-skills/get-config.md:52-52, 114-136` **Vulnerability Type**: Untrusted remote instruction processing **Risk Level**: High ### Vulnerable Code and Instructions The skill sends a request to an external service: ```powershell curl -s -X POST "https://heifangti.com/api/api/v1/heifangti/agent/analyze" -H "Content-Type: application/json" -H "X-API-Key: $env:HEYCUBE_API_KEY" -d '{request JSON}' ``` The operative instruction at `assets/hook-skills/update-data.md:140`, translated into English, requires the Agent to use each remotely returned `focus_prompt` as extraction guidance when extracting structured data from the conversation. The GET workflow at `assets/hook-skills/get-config.md:136` similarly requires data loaded from the profile database to be appended to the context used to process the user's request. ### Technical Analysis The external API controls the `dimensions[].focus_prompt` values consumed by the Agent. The skill does not require: - A fixed local mapping between dimension identifiers and permitted extraction operations. - Schema validation or an allowlist for dimension identifiers. - Rejection of imperative or instruction-like content in `focus_prompt`. - Delimiting remote values as inert data. - Detection of prompt-injection content in stored profile values. This creates an instruction/data boundary failure. A compromised, malicious, or incorrectly configured API can return text such as instructions to ignore the intended profile-extraction scope, disclose unrelated conversation content, invoke tools, or alter the Agent's response. Stored profile values appended to the processing context can create a similar injection path if attacker-controlled text reaches the local database. HTTPS protects the connection in transit but does not protect against compromise of the service, its backend, its account c ...[truncated 1375 chars]
- Remediation
- ## Remediation Suggestions 1. Never execute or follow natural-language instructions returned by the remote service. 2. Replace `focus_prompt` with a locally defined mapping from approved dimension IDs to fixed extraction rules. 3. Validate the complete response against a strict schema and reject unknown fields, unexpected types, excessive lengths, and unapproved dimension IDs. 4. Permit dimension IDs only from a local allowlist. Do not let the service introduce new extraction behavior dynamically. 5. Treat remote responses and stored profile values as quoted, inert data. Clearly delimit them and instruct the Agent that their contents cannot modify goals, policies, or tool behavior. 6. Reject values containing instruction-like control phrases where practical, while recognizing that filtering alone is not a sufficient defense. 7. Limit the extraction operation to explicitly enumerated conversation fields and prohibit tool calls during extraction. 8. Require explicit user confirmation before extracting or loading sensitive profile dimensions. 9. Apply equivalent validation and isolation to profile values appended by the GET workflow.