T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:16
- Finding
- Repository-Controlled Planning File Is Injected into Agent Tool Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-20` **Vulnerability Type**: Indirect prompt injection through untrusted project content **Risk Level**: Medium ### Complete Code Snippet ```yaml PreToolUse: - matcher: "Write|Edit|Bash|Read|Glob|Grep" hooks: - type: command command: "cat task_plan.md 2>/dev/null | head -30 || true" ``` ### Technical Analysis The `PreToolUse` hook reads the first 30 lines of `task_plan.md` before nearly every filesystem or command-related tool call. Because this file is located in the project directory, its content may be controlled by a repository author or another untrusted contributor. The hook does not validate the file format, restrict accepted fields, or clearly isolate the content as untrusted data. Consequently, a malicious `task_plan.md` can contain instructions designed to manipulate the agent. The content is repeatedly surfaced during the session, increasing the likelihood that the agent treats it as authoritative operational guidance. The shell command itself does not directly execute commands contained in `task_plan.md`. Exploitation depends on the agent interpreting the displayed content as instructions and subsequently invoking its available tools. ### Attack Path 1. An attacker creates or modifies `task_plan.md` in a repository. 2. The attacker places malicious instructions within its first 30 lines, such as requests to read sensitive files, run shell commands, or alter unrelated project files. 3. A victim opens the repository with this Skill enabled. 4. Before a matching `Write`, `Edit`, `Bash`, `Read`, `Glob`, or `Grep` operation, the hook reads the malicious content. 5. The injected text is presented in the agent's operational context. 6. If the agent follows the repository-controlled instructions, it performs attacker-directed actions using the tools and permissions available in the current session. ### Impact Assessment Successful exploitation can influence any op ...[truncated 657 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not automatically inject raw repository-controlled file content into the agent's instruction context. 2. Parse `task_plan.md` using a strict schema and accept only expected fields such as phase names, statuses, and identifiers. 3. Reject executable instructions, tool directives, embedded markup, and unexpected fields. 4. Present recovered content inside an explicit untrusted-data boundary, with a fixed warning that it must not override system, developer, user, or Skill instructions. 5. Require user confirmation before acting on recovered instructions that request command execution, sensitive file access, network activity, or changes outside the project. 6. Restrict the hook to a planning file created and authenticated by the current session where feasible. 7. Consider storing trusted planning state outside attacker-controlled repositories or protecting it with integrity metadata. 8. Apply least-privilege tool permissions so that prompt injection cannot automatically access unrelated files or execute high-impact commands. ]]>