T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:92- Finding
Unauthenticated inbox and task files are treated as executable agent instructions
- Content
View full analysis
## 完成后 请将结果回写到任务文件，并将完成状态通知 requesting_agent。 ``` ### Technical Analysis The workflow instructs an agent to read a shared inbox message, follow a linked task file, and perform the described work. It does not require authentication of the inbox-file author, authorization of the requesting agent, integrity verification of the task file, canonical path validation, or explicit approval before sensitive actions. Consequently, write access to the shared inbox or task area can become an instruction-injection channel. A malicious inbox file may point to attacker-controlled content and cause the target agent to interpret that content as an authorized task. The subsequent completion and trace steps can also propagate the injected instructions or their results to other agents and communication channels. ### Attack Path 1. An attacker obtains the ability to create or modify a file under `shared/inbox//`, or compromises an agent that has this ability. 2. The attacker creates a plausible inbox message and links it to a malicious or modified task file. 3. The target agent is awakened through `sessions_send`, a mention, or its normal inbox-processing workflow. 4. Following the skill instructions, the target reads the inbox message and linked task file. 5. The age ...[truncated 782 chars]- Remediation
View remediation