T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:128- Finding
Remote Agent Execution with Permission and Confirmation Controls Disabled
- Content
View full analysis
/dev/null; \ cd ${TEST_DIR} && \ opencode run \ --dangerously-skip-permissions \ \"${FULL_PROMPT}\" \ 2>&1 | tee ${TEST_DIR}/opencode-run.log'" ``` The Skill also requires `FULL_PROMPT` to contain appended directives that authorize cross-directory file access and tell the remote agent to perform every operation automatically without requesting confirmation. ### Technical Analysis The `--dangerously-skip-permissions` option disables OpenCode permission prompts. This is combined with mandatory prompt instructions that suppress user confirmation and authorize cross-directory access. These controls are independent safety boundaries: permission enforcement limits what the agent can do, while confirmation prompts give the user an opportunity to reject sensitive actions. Disabling both allows the target Skill and any instructions it loads to operate with the full filesystem and command privileges available to the remote SSH account. The dedicated test directory does not provide an effective security boundary. OpenCode runs as the SSH user and is explicitly authorized to access other directories. There is no container, operating-system sandbox, restricted service account, or command allowlist. ### Attack Path 1. An attacker modifies or compromises a target Skill in the repository, or supplies a malicious test prompt. 2. The workflow installs the affected Skill on the remote host. 3. The Skill launches OpenCode with `--dangerously-skip-permissions`. 4. The automatically appended prompt prevents the agent from stopping for confirmation and authorizes cross-directory access. 5. The malicious instructions cause the agent to read, alter, or ...[truncated 839 chars]- Remediation
View remediation