T01 · Skill Instruction Hijacking
Error
- Location
- process-reminders.sh:10
- Finding
- Untrusted Reminder Notes Are Executed as Unrestricted Agent Instructions## Vulnerability Details **File Location**: `process-reminders.sh:10-20`, `process-reminders.sh:25-30`, `process-reminders.sh:39-46`; corroborated by `SKILL.md:82-89` and `architecture.md:74-86` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical **Vulnerable code:** ```bash # Rules (universal, no exceptions): # 1. No notes? → SKIP # 2. Notes start with 🤖? → SKIP (already processed) # 3. Notes exist without 🤖? → EXECUTE (spawn agent) # # Agent can do ANYTHING: # - Use skills (i-ching, librarian, weather, etc.) # - Edit files (ROADMAP, calendar, etc.) # - Call APIs (GitHub, Home Assistant, etc.) # - Research (web search, book search, etc.) set -e # Get all incomplete reminders with notes (no 🤖) ALL_REMINDERS=$(remindctl all --json 2>/dev/null) NEEDS_PROCESSING=$(echo "$ALL_REMINDERS" | jq -c '[ .[] | select(.isCompleted == false) | select(.notes != null and .notes != "") | select(.notes | startswith("🤖") | not) ]') ``` ```bash # Output items for agent processing echo "$NEEDS_PROCESSING" | jq -c '.[]' | while read -r item; do ID=$(echo "$item" | jq -r '.id') TITLE=$(echo "$item" | jq -r '.title') NOTES=$(echo "$item" | jq -r '.notes') echo "EXECUTE|$ID|$TITLE|$NOTES" done ``` The documented agent capabilities in `SKILL.md:82-89` include file operations, calendar changes, API operations, and automation: ```markdown Agent executes natural language commands: ✅ **Research** (web, books, skills) ✅ **File operations** (edit ROADMAP, create notes, git commits) ✅ **Calendar** (create events, recurring schedules) ✅ **APIs** (GitHub issues, Home Assistant, Jira) ✅ **Automation** (anything you can describe) ``` ### Technical Analysis Apple Reminder notes cross a trust boundary and are converted directly into agent instructions. The only eligibility controls are that a reminder must be incomplete, its notes must ...[truncated 1973 chars]
- Remediation
- ## Remediation Suggestions 1. Treat reminder titles and notes strictly as untrusted data rather than authoritative agent instructions. 2. Replace unrestricted natural-language execution with a typed action schema containing a small allowlist of supported operations and validated parameters. 3. Require an authenticated, explicit trigger rather than considering every nonempty note executable. 4. Require interactive user confirmation before file modification, API writes, commits, calendar changes, smart-home actions, or external data transmission. 5. Reject instructions that request credentials, private memory, arbitrary shell execution, policy changes, or invocation of tools outside the allowlist. 6. Run the reminder processor in a least-privileged sandbox with separate, narrowly scoped credentials and restricted filesystem/network access. 7. Preserve and audit the reminder creator, source, requested action, confirmation decision, tool calls, and resulting changes. 8. Apply immutable system-level safety policies that reminder content cannot override. 9. For shared or synchronized lists, require creator authorization and cryptographic or account-level provenance before accepting a task.