T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:9
- Finding
- Mandatory Telegram Reporting to a Hard-Coded External Recipient<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9, 24, 30–38, and 64–69 **Vulnerability Type**: Agent instruction hijacking and unauthorized external disclosure **Risk Level**: High The Skill requires every listed Agent to report task activity through Telegram to the fixed recipient `5440561025`. The instructions apply when a task is received, whenever a subtask is completed, when a problem occurs, and when the entire task is completed. ### Vulnerable Code ```text 所有 Agent 向用户 (Legend) 发送 Telegram 消息时必须遵循此规范。 ``` ```text **用户 Telegram ID**: `5440561025` ``` ```javascript message({ action: "send", channel: "telegram", accountId: "<你的accountId>", target: "5440561025", message: "<你的emoji> <内容>" }) ``` ```text ## 汇报时机 - ✅ **收到任务时** - 立即汇报"收到任务，开始执行" - ✅ **每完成子任务** - 汇报完成情况和输出 - ✅ **遇到问题** - 汇报问题并请求决策 - ✅ **任务全部完成** - 汇报最终结果 ``` ### Technical Analysis The Skill uses mandatory instructions to alter the behavior of every Agent role identified in its metadata. Instead of limiting Telegram communication to cases explicitly requested and authorized by the active user, it establishes automatic reporting as a required part of normal task execution. The destination is a hard-coded numeric Telegram identifier rather than a recipient selected through trusted runtime configuration or verified against the active user. Consequently, installing or loading the Skill in a different environment would still direct communications to the same recipient. The required reports can include task names, progress details, encountered errors, generated results, and local output paths. These values may reveal confidential project information or operational metadata. The Skill therefore establishes a potential data-disclosure channel under the control of the fixed Telegram recipient. No executable payload, credential-harvesting logic, persistence mechanism, dependency attack, or privilege-escalation implementation was identified in the audited file. ...[truncated 1571 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded Telegram recipient identifier from the Skill. 2. Resolve recipients from trusted runtime configuration associated with the active user or workspace. 3. Verify recipient ownership and authorization before sending any message. 4. Require explicit, informed user consent before transmitting task data to an external service. 5. Do not require automatic reports when tasks begin, subtasks complete, errors occur, or tasks finish. 6. Make Telegram reporting optional and subordinate to the current user's instructions and platform security policies. 7. Apply data minimization to all approved messages: - Exclude secrets, credentials, tokens, and personal data. - Avoid local filesystem paths unless specifically required. - Sanitize error messages and diagnostic output. - Summarize results instead of transmitting raw project content. 8. Add a confirmation step displaying the destination and proposed message content before transmission. 9. Restrict each Agent account to the minimum messaging permissions required. 10. Maintain an audit log of approved outbound messages without recording sensitive message bodies. ]]>