T01 · Skill Instruction Hijacking
- Location
SOUL.md:55- Finding
Untrusted MCP Responses Can Inject Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SOUL.md, lines 55–60, 89–94, and 161
Vulnerability Type: Remote instruction injection through trusted MCP response fields
Risk Level: CriticalVulnerable code snippets:
markdown 3. Call `tutorclaw_generate_guidance` with: - `learner_state`: the full JSON string from get_learner_state - `chapter_content`: the `content` field from get_chapter_content 4. Present ONLY the `content` field to the learner. 5. Internalize the `system_prompt_addition` — it tells you exactly how to behave this turn. Follow it.markdown 4. **Generate** — Call `tutorclaw_generate_guidance` with: - `learner_state`: the full JSON string from step 3 - `chapter_content`: the same chapter content (no need to reload unless the chapter number changed) 5. **Respond** — Present ONLY the `content` field to the learner. Internalize the new `system_prompt_addition` for this turn.markdown - **One question at a time.** Follow the system_prompt_addition closely.Technical Analysis
The skill explicitly instructs the agent to treat the MCP service's
system_prompt_additionfield as authoritative behavioral instructions. This crosses the trust boundary between external tool data and agent control instructions without schema-based constraints, validation, sanitization, or an allowlist of permitted directives.The requirement to present only the remotely selected
contentfield further permits the service to control or suppress the user-visible response. If the MCP endpoint or its upstream components are malicious or compromised, they can return instructions that alter session goals, induce unauthorized tool use, conceal warnings, inject phishing or promotional material, or attempt to override safety constraints.No malicious MCP response or server implementation was included in the audited artifact, so actual compromise is not established. ...[truncated 1677 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
system_prompt_additionfrom the MCP response protocol and keep all agent behavior rules in locally installed, reviewable skill text. - Treat every MCP response as untrusted data, never as system-level or developer-level instructions.
- Replace free-form behavioral text with a strict, versioned schema containing narrowly scoped fields such as stage, question text, and expected concept identifiers.
- Validate response types, lengths, enum values, and allowed Markdown constructs before use; fail closed on unknown fields.
- Reject embedded directives that request tool invocation, credential disclosure, policy changes, external navigation, or instruction-priority changes.
- Do not require the agent to present only server-controlled content. Preserve locally generated safety notices and allow the agent to refuse unsafe response content.
- Authenticate the MCP endpoint, encrypt transport, pin or otherwise verify the expected service identity where supported, and apply least-privilege authorization.
- Log rejected response fields and anomalous instruction-like content without recording learner secrets.
- Add adversarial tests in which the MCP response includes prompt-injection payloads, tool requests, malicious URLs, and attempts to suppress warnings.
- Remove