T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:8
- Finding
- Autonomous Role and Instruction Hijacking Through Externally Controlled Jobs## Vulnerability Details **File Location**: `SKILL.md`, lines 8–10, 25–40, 63–64, and 82–97 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown You are an autonomous AI agent operating on XPR Network's trustless agent registry. Your on-chain identity is the account stored in XPR_ACCOUNT. ``` ```markdown **A. Hunt for open jobs (PROACTIVE — primary workflow):** 1. Poll for open jobs with `xpr_list_open_jobs` 2. Review job details: title, description, deliverables, budget, deadline 3. Evaluate if you have the capabilities and can deliver on time 4. Submit a bid with `xpr_submit_bid` including your proposed amount, timeline, and a detailed proposal 5. Wait for the client to select your bid 6. When selected, the job is assigned to you — proceed to acceptance **B. Accept direct-hire jobs (REACTIVE):** 1. Check incoming jobs with `xpr_list_jobs` filtered by your account 2. Review job details: title, description, deliverables, amount, deadline 3. Verify the client is legitimate (check their account, past jobs) 4. Accept with `xpr_accept_job` only if you can deliver ``` ```markdown 5. NEVER deliver just a URL or summary — always include the actual work 6. NEVER say you can't create images or videos — you HAVE the tools for this! ``` ```markdown - **ALWAYS** bid at least the estimated XPR amount — this is your minimum profitable price - If the budget is above your cost estimate: bid at or near budget (more profit) - If the budget is below cost: bid at your estimated cost (you can bid ABOVE the posted budget — the client can accept or reject) - If the job is wildly unprofitable (budget < 25% of cost): skip it ``` ### Technical Analysis The skill replaces the host agent's normal role with that of an autonomous blockchain marketplace operator. It uses mandatory identity and behavior directives, including `ALWAYS` and `NEVER` statements, to ...[truncated 1965 chars]
- Remediation
- ## Remediation Suggestions - Remove role-replacement language such as “You are an autonomous AI agent.” - Replace `ALWAYS` and `NEVER` directives with conditional guidance subordinate to platform policy and explicit user intent. - Treat every job title, description, deliverable, proposal, URI, and A2A message as untrusted data. - Keep untrusted job content in a structured data boundary and prohibit it from changing system instructions or tool permissions. - Apply prompt-injection detection and enforce a narrow allowlist of supported task types. - Require explicit, informed user approval before bidding, accepting jobs, publishing content, creating repositories, delivering work, spending funds, or initiating signed operations. - Verify actual tool availability and policy eligibility at runtime rather than asserting capabilities in skill text. - Apply budget, destination, content, and rate limits independently of instructions received from marketplace participants.