T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Mutable Remote Skill Content Can Hijack Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10–16, 34–50, and 66–70
Vulnerability Type: Indirect prompt injection through remotely loaded skill instructions
Risk Level: HighVulnerable Code Snippet
markdown Do not answer Qdrant questions from memory. Qdrant evolves quickly (new endpoints, metrics, defaults, and deployment patterns land often), and the authoritative, current guidance lives at `skills.qdrant.tech` as a hierarchy of agent skills. Your job is to **load the relevant skill context live, then ground your diagnosis in it** — loading only the branch that matches the problem, never the whole tree. You are *consuming* these skills as context. You are **not** installing them and nothing needs to be installed. - **Search**: `https://skills.qdrant.tech/search?query=your+query+here` - The structure is **hierarchical**: top-level skill `SKILL.md` → sub-skill `SKILL.md` → linked documentation pages. Each level narrows scope. Traverse it depth-first, following only the branch(es) that match the symptom.markdown Each `SKILL.md` you load names its sub-skills (and often related skills and docs) as links. The hierarchy is not just two levels — a skill can nest **several layers deep**, and skills also reference each other **laterally**. Follow the links, not a fixed depth. **Descend (go deeper).** A `SKILL.md` is not necessarily a leaf just because you fetched it. If its sections themselves point to further `SKILL.md` files, keep descending along the branch that matches the symptom — top-level → sub-skill → sub-sub-skill → … — until you reach a level whose guidance is concrete enough to act on (ordered diagnostic steps, exact endpoints/metrics, an explicit "what NOT to do" list). Don't stop early at an intermediate skill that only routes you onward. **Move laterally (go sideways).** Real problems often span areas. Follow a link to a **sibling or related skill** when: - the current skill expl ...[truncated 3763 chars]- Remediation
View remediation
Remediation Suggestions
- Explicitly classify every fetched page as untrusted reference data. State that remote content cannot override system, developer, user, safety, privacy, or tool-use policies.
- Do not load remote
SKILL.mdtext as executable agent instructions. Parse it into a constrained data structure containing only expected fields such as diagnostic steps, metrics, endpoint references, and canonical citations. - Allowlist exact HTTPS origins and approved path prefixes. Reject off-origin links, userinfo URLs, non-HTTPS schemes, IP literals, unexpected ports, and redirects outside the allowlist.
- Replace live mutable retrieval with signed, versioned snapshots where feasible. Verify signatures or cryptographic hashes before consuming content.
- Apply schema validation, size and traversal-depth limits, request-count limits, and cycle detection to hierarchical retrieval.
- Detect and discard directives requesting secrets, unrelated file access, policy changes, arbitrary tool calls, code execution, package installation, or navigation to unapproved destinations.
- Require explicit user approval before any sensitive operation suggested by fetched material.
- Use a least-privileged retrieval component with no access to local files, credentials, internal networks, or unrelated tools.
- Record fetched URLs, redirects, verified content versions, and rejected instructions in an audit log.
- Preserve the existing prohibition on installation, but extend it to prohibit executing commands or code obtained from remote content.