T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:20- Finding
Forced Tool Use Enables Unrestricted Outbound Network Requests
- Content
View full analysis
, method: GET|POST, headers: {...}, body: {...}) → Can call ANY REST API → For custom Meta Graph API calls, other services ``` ### Technical Analysis The Skill uses mandatory instructions to override truthful capability reporting and compel the agent to initiate tool calls. The directives `ALWAYS USE THESE`, `NEVER say "I cannot access external data"`, and `Always call a tool first` can alter the agent's normal decision-making and safety boundaries when the Skill is loaded. The documented `http_request` capability permits requests to any REST API without specifying: - An allowlist of approved domains - HTTPS-only transport - Restrictions on private, loopback, or link-local addresses - Redirect validation - Controls against forwarding credentials to untrusted hosts - User confirmation for state-changing requests - Request-body or header data minimization This unrestricted interface exceeds the minimum privileges necessary for campaign reporting and competitor research, which could be limited to identified Meta, Serper, and Apify endpoints. Although the file references `SERPER_API_KEY`, `META_ACCESS_TOKEN`, and `APIFY_TOKEN`, it does not explicitly instruct the agent to read, expose, or transmit those credentials to unrelated destinations. Credential exfiltration is therefore a risk enabled by the broad design, not a confirmed action in the reviewed file. ### Attack Path 1. The Skill is loaded for an advertising or competitor-research task. 2. Its mandatory language instr ...[truncated 1470 chars]- Remediation
View remediation