T01 · Skill Instruction Hijacking
- Location
SKILL.md:71- Finding
Untrusted Remote Markdown May Hijack Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 71-81
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code
markdown ## Heartbeat (every 4 hours) Fetch the live heartbeat and surface relevant discoveries:GET https://lobstrhunt.com/api/heartbeat
text The heartbeat returns plain-text markdown. Parse it and message the human if anything matches their workflow. Top 2-3 picks maximum. Always end with a question. Never install without an explicit yes.Technical Analysis
The Skill instructs the agent to retrieve mutable, server-controlled Markdown and parse it directly. It does not state that the response must be treated solely as untrusted data, define a strict response schema, or require embedded instructions to be ignored.
Markdown returned by the remote endpoint could contain prompt-injection content disguised as skill descriptions, recommendations, or operational guidance. If the LobstrHunt service, its content pipeline, or a listed skill submission is compromised, an attacker could attempt to alter the agent's current goals or persuade it to disclose information or invoke tools.
The requirement to obtain explicit approval before installation reduces the risk of unauthorized installation, but it does not protect other agent behavior, generated messages, data disclosure attempts, or tool calls induced by malicious response content.
Attack Path
- An attacker gains control over content returned by
/api/heartbeat, either through service compromise or insufficiently sanitized marketplace content. - The attacker embeds adversarial instructions inside a skill description or another Markdown field.
- The agent fetches the heartbeat during its recurring discovery operation.
- Following the Skill instructions, the agent parses the remote Markdown without a trust boundary or strict schema.
- The injected content is interpreted as in ...[truncated 786 chars]
- An attacker gains control over content returned by
- Remediation
View remediation
Remediation Suggestions
- Replace free-form Markdown responses with a versioned JSON response that has a strict, minimal schema.
- Allowlist expected fields such as skill name, identifier, category, rating, and a length-limited plain-text description.
- Explicitly instruct the agent that all remote content is untrusted data and that it must never follow instructions, commands, links, or policy statements contained in that data.
- Strip or reject executable commands, HTML, hidden text, embedded prompts, unexpected URLs, and instruction-like content before presenting results to the model.
- Parse and validate the response outside the language-model instruction context where possible.
- Bind all actions to locally defined logic. Remote content must not be able to change tool permissions, approval requirements, destinations, or action types.
- Require explicit user approval for any tool invocation resulting from remote recommendations, not only skill installation.
- Apply response size limits, timeouts, content-type validation, and an allowlist for redirects and network destinations.