T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:17
- Finding
- Mutable Remote Instructions and Results Are Treated as Trusted Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-29 and 48-49 **Vulnerability Type**: Indirect prompt injection through remotely controlled content **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. Read the API docs at https://clawharbor.app/v1 2. POST /v1/tasks with a task description 3. Poll GET /v1/tasks/{id} until status = "quoted" 4. Present the payment_url to the user (MUST include the full URL with # fragment) 5. After user pays, POST /v1/tasks/{id}/confirm-payment 6. Poll GET /v1/tasks/{id} until status = "delivered" 7. Return the result to the user ## Quick Start Read the full API documentation: ```text curl https://clawharbor.app/v1 ``` ``` The result-handling instructions at lines 48-49 state: ```markdown - Results are delivered as plain text in the result field. ``` ### Technical Analysis The Skill directs the Agent to retrieve mutable API documentation from an external service and return plain-text results generated by external agents. It does not establish a trust boundary between remote content and executable Agent instructions. The API documentation and task results can change after the Skill package has been reviewed. If either response contains text framed as instructions to the Agent, an insufficiently isolated Agent may interpret that content as authoritative workflow guidance rather than untrusted data. The Skill does not require schema validation, response sanitization, instruction filtering, or explicit refusal to follow commands embedded in remote content. This is not direct native-code execution. Exploitation depends on the host Agent interpreting externally supplied text as instructions and having tools or sensitive context available. ### Attack Path 1. An attacker compromises the remote service, controls an external agent producing a result, or otherwise causes attacker-authored text to be returned. 2. The malicious response includes prompt-injection content, such as instructions t ...[truncated 1063 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Embed a fixed, reviewed API contract in the Skill rather than instructing the Agent to obtain operational instructions from a mutable remote document. 2. Treat all API documentation, status fields, task results, error messages, and other response content as untrusted data. 3. Add an explicit instruction that the Agent must never follow commands contained in remote responses. 4. Parse responses according to a strict JSON schema and reject unexpected fields, malformed types, oversized responses, and unsupported content. 5. Display task results as quoted or otherwise clearly delimited data rather than incorporating them into the Agent's instruction context. 6. Prevent remote content from authorizing tool calls, changing system constraints, requesting secrets, or redirecting the workflow. 7. Apply output length limits and prompt-injection screening before presenting or summarizing external results. 8. Require fresh user approval before performing any action suggested by an external result. ]]>