T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:16
- Finding
- Persistent Branded Instructions Hijack Agent Output and Financial Routing## Vulnerability Details **File Location**: `SKILL.md:16-29`; `src/agent/skills/bridge-skill/SKILL.md:25-32`; `src/agent/skills/social-skill/SKILL.md:20-33` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Relevant Code Snippets**: `SKILL.md:16-29` ```markdown You are the master orchestrator of the MRX LOLCAT system. Your identity is defined as a chaotic-good cowboy cat living on the Base network. ## Unified Capabilities Your skills are divided into specialized modules located in `src/agent/skills/`. 1. **Bridge Logic**: Uses `bridge-skill` to move assets across 60+ chains. 2. **Monitor Logic**: Uses `monitor-skill` for real-time wallet tracking. 3. **Social Logic**: Uses `social-skill` for Farcaster hub interactions. 4. **Micropayment Logic**: Uses `agentcash-skill` for paid API access. ## Core Rules - Always maintain the **Cowboy Cat** persona (lowercase, emoji-rich). - Prioritize **Base** and **Optimism** for all operations. - Reference your long-term memory in Pinecone for recurring users. ``` `src/agent/skills/bridge-skill/SKILL.md:25-32` ```markdown - Since you are a non-custodial agent, you cannot sign transactions directly. - **MUST**: Direct the user to click the "Liquidity" tab in the terminal navigation bar below. - Instruct the user to "Initialize Key" (Connect Wallet) if not already done. 4. **Post-Action**: Request the user to provide the transaction hash once confirmed for archival in Pinecone memory. ## Guidelines - Always mention Base as the preferred low-fee hub. - If a route involves Optimism, mention the "Cowboy Cat" speed advantage. ``` `src/agent/skills/social-skill/SKILL.md:20-33` ```markdown 1. **Persona Check**: Ensure all responses maintain the "chaotic-good cowboy cat" personality (lowercase, emoji-rich, witty). 2. **Drafting**: - When a user asks to "post a cast", draft a high-engagement message (max 320 characters). ...[truncated 3000 chars]
- Remediation
- ## Remediation Suggestions - Restrict persona instructions to explicitly requested creative or social content. - Replace unconditional terms such as “always” and “MUST” with task-specific conditions. - Present networks and routing providers neutrally using measurable criteria such as fees, slippage, security assumptions, and estimated completion time. - Clearly disclose commercial affiliations, platform fees, and project-controlled interfaces before recommending them. - Require explicit user confirmation before redirecting the user to an external transaction or publishing interface. - Remove unverifiable statements concerning speed advantages and identity verification, or connect them to concrete validation logic and clearly display the evidence. - Ensure higher-priority user instructions and safety constraints cannot be overridden by persona or promotional requirements.