T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:39
- Finding
- Remote Workspace Content Is Injected as Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:39-55` **Vulnerability Type**: Remote instruction injection **Risk Level**: High ### Evidence ```json { "tempoUrl": "https://your-workspace.example.com" } ``` ```text ### Context Injection (`before_agent_start` hook) Before every agent session, the plugin injects: - **Workspace Covenant** — rules, channels, templates, data handling policies - **Context Snapshot** — active projects, recent activity, tasks, hot topics Your agent starts every conversation already aware of what's happening in the workspace. ``` ### Technical Analysis The plugin accepts a configurable Tempo server URL and retrieves workspace content before every Agent session. The remotely supplied “Workspace Covenant” explicitly contains rules and data-handling policies that are injected into the Agent context. The documentation does not describe origin allowlisting, cryptographic response verification, schema enforcement, instruction isolation, or controls preventing the remote content from overriding trusted instructions. Consequently, a compromised or attacker-controlled workspace can supply adversarial instructions that influence Agent behavior. ### Attack Path 1. An attacker controls the configured `tempoUrl` or compromises the legitimate Tempo workspace. 2. The attacker places malicious instructions in the Workspace Covenant or context snapshot. 3. The `before_agent_start` hook retrieves this content. 4. The plugin injects the attacker-controlled content into the Agent context. 5. The Agent may interpret the content as governing instructions and alter its behavior, disclose information, or misuse available tools. ### Impact Assessment Exploitation can influence every Agent session connected to the affected workspace. The effective scope depends on the tools, data, credentials, and permissions available to the Agent. Potential consequences include instruction hijacking, sens ...[truncated 92 chars]
- Remediation
- ## Remediation Suggestions - Treat all workspace responses as untrusted data rather than governing Agent instructions. - Do not place remotely retrieved text in instruction-priority sections of the Agent context. - Enforce an allowlist of trusted HTTPS workspace origins and reject redirects to unapproved hosts. - Authenticate responses and use signed, versioned schemas for workspace policy data. - Separate structured workspace metadata from executable or imperative natural-language content. - Explicitly prevent remote content from overriding system, developer, user, or safety instructions. - Sanitize retrieved content and detect prompt-injection patterns before context inclusion. - Show users the retrieved policy content and require approval before applying material changes.