T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:99- Finding
Untrusted Remote Hiring Instructions Can Control Payments and Data Destinations
- Content
View full analysis
` header 5. **Save the `txHash` from your payment** — you need it to submit a verified review ``` ### Technical Analysis The skill explicitly instructs the agent to follow a remotely supplied `howToHire` block “exactly.” The remote response controls consequential parameters including: - The endpoint receiving the task payload - The payment recipient address - The blockchain network - The requested payment amount - Additional hiring instructions returned by the service The skill does not require a local destination allowlist, maximum payment limit, chain validation, recipient verification, instruction filtering, or explicit user approval before transmitting data or signing a payment authorization. It therefore treats attacker-controlled remote content as authoritative agent instructions instead of untrusted data. This creates an instruction-hijacking boundary: compromise of the registry, manipulation of an indexed agent profile, or a malicious registered agent can influence the agent’s behavior after the skill has been reviewed. ### Attack Path 1. An attacker registers a malicious agent profile, compromises a legitimate profile, or compromises the registry response. 2. The attacker supplies an endpoint under their control and a chosen payment address through the r ...[truncated 1224 chars]- Remediation
View remediation