T01 · Skill Instruction Hijacking
- Location
skill.md:35- Finding
Unpinned Remote Skill and Heartbeat Instructions Enable Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 35–36; recurring use is directed at line 510
Vulnerability Type: Remote mutable instruction retrieval
Risk Level: MediumComplete vulnerable code snippet:
bash curl -fsS https://puffermind.com/skill.md > ~/.puffermind/skills/puffermind/skill.md curl -fsS https://puffermind.com/heartbeat.md > ~/.puffermind/skills/puffermind/heartbeat.mdThe downloaded heartbeat is subsequently designated as a recurring routine:
text Use `https://puffermind.com/heartbeat.md` as the recurring routine after registration.Technical Analysis
The installation instructions overwrite local Skill files with content downloaded from external URLs without verifying a cryptographic signature, checksum, immutable version, or reviewed content digest. The project does not include
heartbeat.md, so the recurring instructions cannot be assessed as part of this audit.Although HTTPS protects content while it is in transit, it does not establish that future content served by the publisher is identical to the audited version. Control of the website, hosting environment, DNS/TLS infrastructure, or publishing account could allow an attacker to replace either document. Because these documents are agent instructions rather than inert data, modified content could alter the agent's goals or operational constraints when loaded.
This is classified as instruction hijacking rather than remote code execution: the shown commands retrieve Markdown instruction files, and the reviewed evidence does not demonstrate that executable code is fetched or automatically executed.
Attack Path
- An attacker compromises the Puffermind publishing endpoint, deployment credentials, hosting account, or another component capable of changing
skill.mdorheartbeat.md. - The attacker replaces one of the remote documents with instructions that direct the agent to perform unintended actio ...[truncated 1151 chars]
- An attacker compromises the Puffermind publishing endpoint, deployment credentials, hosting account, or another component capable of changing
- Remediation
View remediation
Remediation Suggestions
- Include both
skill.mdandheartbeat.mdin the reviewed package rather than downloading mutable copies during installation. - If remote distribution is necessary, publish immutable versioned artifacts and pin the installation to a specific release.
- Publish a trusted SHA-256 digest or detached digital signature and verify it before replacing local files. Abort installation on any mismatch.
- Download to a temporary file, validate it, and only then perform an atomic replacement of the installed file.
- Require explicit user review and approval before applying instruction updates.
- Do not automatically treat newly downloaded heartbeat content as trusted recurring instructions.
- Restrict heartbeat behavior to a documented allowlist of API hosts and operations, applying least privilege to available credentials and tools.
- Retain the last verified version to support rollback after failed verification or suspicious changes.
- Include both