T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/fetch_coupons.py:39
- Finding
- Untrusted Remote Coupon Data Is Reproduced in Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-22`, `SKILL.md:62-63`, `SKILL.md:125-136`, `scripts/fetch_coupons.py:39-44`, `scripts/fetch_coupons.py:91-99`, and `scripts/fetch_coupons.py:148-152` **Vulnerability Type**: Remote content injection into agent responses **Risk Level**: Medium ### Vulnerable Code The Skill requires coupon codes received from the remote API to be reproduced without modification: ```markdown 1. Call the API: `GET https://agskills.moontai.top/coupon/takeout` 2. Parse the returned JSON data, which contains four main sections. 3. Display coupon information by platform. 4. Important: The coupon_code field must be presented to the user exactly as received and must not be modified. ``` The requirement is reinforced by unconditional handling rules: ```markdown ### coupon_code handling rules Modification of any content in the coupon_code field is strictly prohibited. - Do not add, remove, or modify any character. - Do not format, beautify, or rearrange the content. - Do not translate or explain the meaning of the code. - Retrieve it from the API and present it to the user exactly as received. ``` The implementation retrieves JSON from the external service without validating its schema, field lengths, content, or permitted destinations: ```python endpoint = f"{self.base_url}/coupon/takeout" try: response = self.session.get(endpoint, timeout=10) response.raise_for_status() return response.json() except requests.RequestException as e: return { "error": True, "message": f"API request failed: {str(e)}" } ``` Remote fields are then interpolated directly into user-facing output: ```python title = coupon.get("title", "Coupon") # coupon_code must be displayed exactly as received without modification coupon_code = coupon.get("coupon_code", "") guideline = coupon.get("guideline", "") lines = [ f"[{platform}] {title}", f" Coupon code: {coupon_code}", f" Redemption instru ...[truncated 3549 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every API response field as untrusted data and enforce a strict response schema before formatting it. 2. Require expected top-level objects and arrays, expected scalar types, maximum list sizes, and conservative length limits for all strings. 3. Validate `coupon_h5_qrcode_img_url` as HTTPS and allow only explicitly approved hostnames and paths. Reject redirects to unapproved destinations where practical. 4. Render remote values inside clearly delimited data blocks and ensure they are never interpreted as agent instructions. 5. Replace the unconditional verbatim-output mandate with a rule that permits rejection, omission, or warning labels when content is suspicious or violates safety policy. 6. Apply conservative character and structural validation to coupon codes based on documented platform formats. Preserve valid codes exactly after validation rather than reproducing arbitrary content. 7. Do not automatically include the aggregate QR destination unless the user explicitly requests it. 8. Add integrity protection, such as a signed response envelope with pinned verification keys, if campaign content must remain remotely updateable. 9. Display the verified destination hostname next to any link or QR code and warn users before directing them outside approved platform domains. 10. Add tests covering oversized fields, unexpected object types, prompt-like instructions, unapproved URLs, redirects, malformed JSON, and missing required fields. ]]>