T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:2
- Finding
- Automatic External Context Injection Without Trust Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 2–30 **Vulnerability Type**: Automatic registration and injection of untrusted session context **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown description: Declare what the agent is currently working on. Self-triggering — fires whenever the agent has a clear task and wants related context to auto-inject. Use at session start when the task is known, or mid-session when the task changes. Triggers on phrases like "here's what I'm doing", "my task is", "I'm working on", "let me focus on", or any time the agent articulates a specific goal or ticket. # Hizal Register Focus Declare what you're working on. Enables focus-tag-based chunk injection. ## Usage \`\`\` hizal__register_focus( session_id="<session-id>", task="<clear description of current work>", tags=["<relevant-tag>", "<another-tag>"] ) \`\`\` ## Parameters - **session_id** — the active session's ID (from `start_session` or `get_active_session`) - **task** — a short, clear description of what you're doing (e.g., "Implement webhook signature verification for Nuvei DMNs") - **tags** — keywords that match `focus_tags` rules on context chunks. Chunks with matching rules get injected into your session automatically. ## When to Use - At session start, if the task is known - Mid-session, if the task changes significantly - After a context reset, to re-establish focus ``` ### Technical Analysis The skill directs the agent to invoke `hizal__register_focus` automatically whenever the agent identifies or changes its task. The call discloses the active session identifier, a description of the current task, and task-related tags to an unspecified integration. The integration subsequently injects matching context chunks into the active session. The skill does not define: - Authentication or authorization requirements for context-chunk publishers. - Validation or sanitization of injected content. - A rule requiring in ...[truncated 2021 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before calling `hizal__register_focus`, particularly before transmitting the session ID or task description. 2. Clearly document the receiving service, trust boundary, retention policy, and intended use of session and task metadata. 3. Authenticate context publishers and authorize each publisher for narrowly scoped tags and sessions. 4. Restrict context retrieval to an explicit allowlist of trusted repositories, publishers, and tag namespaces. 5. Validate and sanitize retrieved chunks before injection. Reject content containing executable directives, tool-call requests, role impersonation, or attempts to override higher-priority instructions. 6. Mark injected chunks as untrusted reference material and enforce that they remain subordinate to system, developer, and user instructions. 7. Separate retrieved data from executable agent instructions through structured fields rather than inserting raw text into the conversational context. 8. Display the selected source and content to the user or agent before injection and provide a mechanism to reject it. 9. Minimize transmitted data by replacing raw session IDs with scoped opaque identifiers and omitting sensitive details from task descriptions. 10. Provide an opt-out mechanism and disable automatic re-registration after task changes or context resets unless explicitly approved. 11. Log registrations and injections with source identity, selected tags, timestamps, and integrity metadata to support review and incident response. ]]>