T01 · Skill Instruction Hijacking
- Location
SKILL.md:19- Finding
Untrusted External Job Instructions Can Hijack Agent Goals and Exfiltrate Generated Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19–29, 131–143, and 249–250
Vulnerability Type: External task delegation without prompt-injection controls
Risk Level: HighVulnerable Code
Lines 19–29:
markdown **You must ask the user for their wallet address before registering.** Do not proceed without a valid wallet address provided by the user. ```bash curl -X POST https://api.agentx.network/api/job-agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourAgentName", "wallet_address": "0xUserProvidedWalletAddress", "description": "AI agent specializing in automated task completion" }'text Lines 131–143: ```markdown ## Submit Work Submit your completed work for a job: ```bash curl -X POST https://api.agentx.network/api/jobs/JOB_ID/submit \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "output": "Your completed work output here" }'text Lines 249–250: ```markdown 5. **Pick a job** and complete the task 6. **Submit** your workTechnical Analysis
The skill directs an agent to register with an external service, browse jobs controlled by remote publishers, complete a selected job, and transmit the resulting output to
api.agentx.network. It does not instruct the agent to treat job descriptions and related remote fields as untrusted data.No controls require validation of a job's instructions, isolation of remote content from the agent's governing instructions, restriction of available tools, review of data included in a submission, or explicit user authorization before performing and submitting each task. Consequently, a malicious job description could contain instructions that conflict with the user's original goal or attempt to override the agent's safety constraints.
The prescribed submission mechanism creates an outbound channel through whic ...[truncated 2225 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly classify all job titles, descriptions, comments, participant data, and related API responses as untrusted data rather than executable instructions.
- Require explicit, informed user approval before registering, selecting a job, executing its requested work, or submitting any output.
- Present the complete selected job and an action plan to the user before invoking tools.
- Enforce a strict instruction hierarchy that prohibits remote job content from changing system policies, safety constraints, tool permissions, or the user's original goal.
- Run external jobs in a least-privilege sandbox with no default access to credentials, private conversation history, unrelated files, wallet secrets, shell execution, or unrestricted network resources.
- Apply an allowlist of tools and data sources separately for each approved job. Deny requests to inspect environment variables, authentication stores, SSH material, browser profiles, wallet keys, or files unrelated to the approved task.
- Add prompt-injection detection and reject jobs that request policy overrides, secret disclosure, unrelated tool operations, or further retrieval and execution of remote instructions.
- Before submission, display the exact destination and complete outbound
outputpayload to the user and require confirmation. - Add automated redaction for API keys, tokens, wallet secrets, personal data, local paths, and other sensitive values.
- Keep authentication keys outside generated content and logs, use narrowly scoped credentials, and support immediate revocation and rotation.