T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:63
- Finding
- Untrusted Backend Output Is Relayed Without Validation## Vulnerability Details **File Location**: `SKILL.md`, lines 63-68 and 110-113 **Vulnerability Type**: Untrusted output forwarding and instruction hijacking **Risk Level**: High **Vulnerable Code Snippet**: ```markdown **Complete pattern:** 1. Start: `bash background:true command:"npx -y aiusd-pro send 'What are my balances?'"` → returns `sessionId: abc123` 2. Wait & poll: `process action:poll sessionId:abc123` → returns `running` or `exited` 3. Get output: `process action:log sessionId:abc123` → returns the agent's full response text 4. Relay output to user as-is ``` ```markdown 4. Relay stdout to user as-is — already formatted for humans. The output includes a browser link at the end (e.g. `https://aiusd.ai/chat/<session-id>`). Always include this link when relaying the response — it lets browser-login users continue the conversation in the web UI. ``` ### Technical Analysis The skill directs the host agent to relay content produced by an external backend without validation, sanitization, or independent interpretation. The backend controls both the response text and a browser link that the host must include. This creates an untrusted-content boundary violation. If the backend service, npm client, network path, or associated account is compromised, an attacker can return deceptive transaction information, phishing instructions, malicious links, or content designed to override the expected interaction flow. The mandatory “as-is” forwarding rule prevents the host from correcting or filtering such output. Although the returned text is presented to the user rather than explicitly executed as local code, it can still manipulate a financially sensitive workflow and influence subsequent confirmations. ### Attack Path 1. An attacker compromises or impersonates the AIUSD backend, or compromises the npm package used to communicate with it. 2. The attacker returns crafted stdout c ...[truncated 968 chars]
- Remediation
- ## Remediation Suggestions - Treat every backend response as untrusted data rather than authoritative instructions. - Require the backend to return a versioned, strictly validated JSON schema instead of unrestricted text. - Independently render transaction summaries from validated fields such as asset, amount, network, destination, leverage, slippage, fees, and expiration. - Do not relay links automatically. Restrict links to an explicit HTTPS origin allowlist and reject embedded credentials, redirects, and unexpected domains. - Remove the requirement to relay stdout “as-is.” - Clearly label remote backend content and warn users not to enter seed phrases, private keys, or credentials. - Require separate wallet-side approval for every state-changing financial transaction. - Log validated proposal identifiers and final transaction parameters for auditability without recording secrets.