T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:38
- Finding
- Untrusted Remote Content Is Processed Without Prompt-Injection Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 38-46 **Vulnerability Type**: Untrusted content processing and indirect prompt injection **Risk Level**: Medium **Vulnerable Code**: ```bash # 5. Get news web_fetch "https://cointelegraph.com/rss" web_fetch "https://tokeninsight.com/rss/news" # 6. Get calendar web_fetch "https://incrypted.com/en/calendar/" ``` Then assemble and send using `message` tool. ### Technical Analysis The Skill directs the agent to retrieve content from external RSS feeds and a scraped calendar page, then incorporate that content into a report sent through the `message` tool. It does not instruct the agent to treat remote content as untrusted data, ignore embedded instructions, restrict extraction to expected fields, or prevent fetched content from influencing subsequent tool calls. RSS entries, article text, or calendar content could contain instruction-like text. If a source is compromised or permits attacker-controlled content, an agent may interpret that text as operational instructions rather than report data. This creates an indirect prompt-injection path. The network requests themselves retrieve public cryptocurrency information and do not transmit local files, credentials, environment variables, private keys, or other sensitive information. No remote code execution mechanism was identified. ### Attack Path 1. An attacker publishes malicious instruction-like content through one of the fetched sources, or compromises the source. 2. The agent retrieves the content using `web_fetch`. 3. The content is placed in the agent's active context without a trust-boundary warning or structured parsing requirement. 4. The agent may follow embedded instructions while assembling the report. 5. The manipulated report may be sent through the `message` tool, or the attacker may attempt to influence other tools available in the session. ### Impact Assessment Successful exploitati ...[truncated 555 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly state that all fetched web and RSS content is untrusted data and must never be treated as instructions. 2. Restrict extraction to an allowlist of fields, such as article title, canonical URL, publication time, source, and a bounded summary. 3. Discard or escape content containing tool directives, role markers, system-style instructions, or requests to modify recipients and configuration. 4. Require the agent to preserve the user-confirmed destination and prohibit fetched content from changing it. 5. Require explicit user confirmation before invoking any tool beyond the tools needed to retrieve data and send the expected report. 6. Prefer a structured RSS parser over unrestricted page ingestion and enforce content-length limits. 7. Add source attribution and avoid presenting unverified fetched claims as authoritative financial information.