T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:17
- Finding
- Untrusted External Instruction Inclusion Through Relative File References## Vulnerability Details **File Location**: `SKILL.md:17-19` **Vulnerability Type**: External instruction inclusion **Risk Level**: High **Vulnerable code snippet**: ```markdown ## Pre-flight Checks > Read `../okx-agentic-wallet/_shared/preflight.md`. If that file does not exist, read `_shared/preflight.md` instead. ``` ### Technical Analysis The Skill instructs the agent to load additional instructions from a relative path outside the audited Skill directory. The primary path traverses into a sibling package, while the fallback path refers to another file that is not included in the audited project. Because neither referenced file was available in the supplied artifact, their contents and integrity could not be verified. If an attacker can create or modify either file, they can introduce arbitrary instructions into the agent's active context when the Skill is loaded. Those instructions could attempt to alter the current task, override safety boundaries, request sensitive information, or induce unauthorized tool operations. This is an instruction-hijacking trust-boundary issue rather than direct native code execution. Its practical impact depends on the agent's available tools, whether loaded documents are treated as authoritative instructions, and the attacker's ability to modify the referenced files. ### Attack Path 1. An attacker gains write access to `../okx-agentic-wallet/_shared/preflight.md`, or to the fallback `_shared/preflight.md`. 2. The attacker inserts instructions that redirect the agent's behavior, solicit sensitive information, or request unsafe tool actions. 3. A user invokes the `okx-dex-ws` Skill. 4. The Skill directs the agent to read the attacker-controlled preflight file. 5. The agent incorporates the external text into its active context. 6. If the agent treats that text as trusted instructions, the attacker can influence the current session within the limits of the agent's tools and permis ...[truncated 472 chars]
- Remediation
- ## Remediation Suggestions - Bundle the required preflight guidance inside the audited Skill package rather than loading it from a sibling directory. - Resolve and validate paths against an explicit allowlisted root, rejecting parent-directory traversal. - Pin the expected external file to a cryptographic digest or signed release if an external dependency is unavoidable. - Treat loaded documents as untrusted reference material rather than executable agent instructions. - Prevent externally loaded content from overriding system policies, requesting unrelated tool use, or changing the user's task. - Display the source and integrity status of externally loaded guidance before using it. - Fail closed when the expected trusted file is unavailable instead of silently selecting an unverified fallback.