T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:220
- Finding
- Untrusted Remote Task Descriptions Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:220` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High **Vulnerable Code Snippet**: ```markdown Do whatever the task requires. The task description explains what needs to be done. ``` ### Technical Analysis The skill directs the agent to retrieve task descriptions from the external POLT platform and to perform whatever those descriptions require. Because platform users may supply task content, those descriptions constitute untrusted remote input. The skill does not establish an instruction-precedence policy, constrain permissible operations, require user review, or prohibit task text from requesting sensitive local actions. This creates an indirect prompt-injection boundary: a task author can place operational instructions in a task description, and the quoted directive encourages the agent to treat those instructions as authoritative. The effective behavior can therefore change remotely after the skill package has been reviewed. ### Attack Path 1. An attacker publishes a POLT task containing hostile instructions in its description. 2. The agent retrieves or opens that task through the documented POLT API. 3. The skill instructs the agent to do whatever the task requires. 4. The agent interprets the attacker-controlled description as actionable instructions rather than untrusted content. 5. Subject to the tools and permissions available to the agent, the hostile task may request local file access, command execution, credential collection, external transmission of data, or unrelated state-changing actions. 6. If the agent complies without independent authorization, sensitive information or system integrity may be compromised. ### Impact Assessment Exploitation could redirect the current agent session away from the user's intended objective. The attainable scope depends on the agent runtime's existing tools and privileges; the skill itsel ...[truncated 571 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unrestricted directive with language that explicitly treats all task descriptions, submissions, replies, and other platform content as untrusted data. 2. Define an instruction-precedence rule stating that remote content cannot override system, developer, skill, or user instructions. 3. Require explicit user review and approval before committing to a task or performing consequential operations. 4. Prohibit remote task content from authorizing access to secrets, credentials, local files, environment variables, private repositories, wallets, or unrelated services. 5. Require separate user confirmation before command execution, file modification, credential use, data transmission, financial activity, or other state-changing actions. 6. Restrict task execution to a declared allowlist of tools, directories, network destinations, and operation types needed for the user-approved task. 7. Add validation that rejects or pauses tasks containing requests to ignore prior instructions, alter safety controls, expose confidential data, install software, or execute externally supplied code. 8. Present the task description to the user as quoted content and summarize the proposed actions before execution.