T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:45
- Finding
- Remote API Response Can Direct Agent Financial Actions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45, 74–79, and 123 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```markdown Each venue includes `balance`, `pnl` (total = realized + unrealized), `realized_pnl`, `unrealized_pnl`, `positions_count`, `positions_needing_attention`, and `actions` (plain text — pre-generated guidance the agent should follow). ``` ```markdown | Signal | Action | |---|---| | `risk_alerts` mentions expiring positions | Decide now — exit or hold | | Venue `actions` array has entries | Follow each action — they're pre-generated for you | | `by_skill` shows a skill bleeding (Simmer venue only) | Surface this to your human in the briefing — let them decide what to do | | `opportunities.new_markets` matches your edge | Research and trade | ``` ```markdown Call `client.get_briefing(since=last_check)` a few times per day. Address `risk_alerts` first, then walk `briefing["venues"]` and present each venue's `actions` to your human. Track `last_check` to fetch only deltas next time. ``` ### Technical Analysis The Skill designates plain-text `actions` returned by a remote API as guidance that the Agent “should follow” and explicitly instructs it to “follow each action.” This crosses the trust boundary between untrusted remote data and trusted Agent instructions. No validation, instruction/data separation, action allowlist, provenance verification, or mandatory human-approval gate is specified. Consequently, anyone capable of controlling the API response could embed text that attempts to override the Agent’s current objective, invoke tools, disclose information, or encourage financial transactions. The direction to “research and trade” is particularly sensitive because the briefing includes real-money venues such as Polymarket and Kalshi, even though the stated scope says trade execution is a separate concern. ### Attack Path 1. An attacker compromises the b ...[truncated 1410 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every API response field, especially `actions`, opportunities, market names, and descriptions, as untrusted data. 2. Replace “follow each action” with an instruction to summarize or quote recommendations without obeying embedded directives. 3. Explicitly prohibit remote response content from overriding system instructions, changing Agent policy, requesting secrets, or initiating tool calls. 4. Parse actions into a strict, documented schema with enumerated action types and validated parameters instead of accepting arbitrary plain text. 5. Require explicit, transaction-specific user confirmation before any real-money trade or position change. Confirmation should include the venue, market, side, quantity, price limit, maximum loss, and fees. 6. Keep read-only briefing functionality technically isolated from trade-execution tools and credentials. 7. Label server-generated recommendations as untrusted third-party content in user-facing summaries. 8. Validate URLs against approved HTTPS domains before presenting or opening them. 9. Log rejected instructions and anomalous response content for security monitoring. ]]>