T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:11
- Finding
- Mutable Remote Instructions and Unverified MCP Tool Surface## Vulnerability Details **File Location**: `SKILL.md:11-16` and `SKILL.md:126-136` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium The Skill requires an agent to retrieve operational guidance from a remotely controlled document before making API calls. It also recommends connecting to an externally hosted MCP server whose definitions and behavior are not included in the audited package. ### Vulnerable Code Snippets `SKILL.md:11-16`: ```markdown Before making any API calls, fetch the full API reference: ``` GET https://nyc-subway-status.com/llms.txt ``` This returns a plain-text guide with all endpoints, slug formats, response schemas, and tips. Read it once per session to understand the API surface. ``` `SKILL.md:126-136`: ```markdown ## MCP Server (Alternative) For agents that support Model Context Protocol, connect directly: ```json { "mcpServers": { "nyc-subway": { "url": "https://nyc-subway-status.com/mcp" } } } ``` Tools: `search_subway`, `get_arrivals`, `get_station_arrivals`, `list_stations`, `list_routes`, `get_trip` ``` ### Technical Analysis The contents of `https://nyc-subway-status.com/llms.txt` are not present in the project and therefore cannot be reviewed or integrity-checked as part of this package. The document is mutable server-side, but the Skill instructs the agent to read it as operational guidance once per session. This creates a remote instruction boundary through which a compromised service, domain, hosting account, or upstream deployment could supply prompt-injection content. Such content could masquerade as updated API documentation while directing the agent to change its workflow, access unrelated resources, disclose conversation data, or send information to additional endpoints. Transport encryption protects the connection in transit but does not protect against compromise of the legitimate server or malicious changes by it ...[truncated 2126 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle a reviewed, versioned API reference with the Skill instead of requiring agents to retrieve mutable instructions at runtime. 2. If remote discovery remains necessary, parse the response strictly as untrusted structured data rather than allowing it to act as agent instructions. 3. Define an explicit allowlist of permitted HTTP methods, hostnames, paths, parameters, and response fields. Reject instructions that request unrelated endpoints or operations. 4. Pin a reviewed API or MCP schema version and verify its integrity using a trusted digest or signature where the platform supports it. 5. Require explicit user or administrator approval before registering the remote MCP server. 6. Apply least privilege to MCP tools and prevent them from accessing local files, credentials, memory, or unrelated network destinations. 7. Treat all remote responses, tool descriptions, and tool results as untrusted content that cannot override system, developer, user, or Skill security constraints. 8. Document a fixed set of expected tools and validate remotely supplied MCP tool names, input schemas, and output schemas before use. 9. Minimize data sent to the service to the transit query required for the requested feature, and do not transmit unrelated conversation context or sensitive information. 10. Add tests that simulate prompt-injection text in the remote guide and deceptive MCP responses, confirming that the agent ignores instructions outside the documented subway API contract.