T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:8
- Finding
- Unverified External Instructions Control Security-Critical Ethereum Transactions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 33 **Vulnerability Type**: External instruction delegation outside the audited trust boundary **Risk Level**: High ### Vulnerable Code ```markdown See the full registration skill spec at `{baseDir}/../../skills.md`. ``` ```markdown 4. Full procedure, ABIs, safety constraints, and contract addresses in `{baseDir}/../../skills.md` ``` ### Technical Analysis The Skill delegates its security-critical operating instructions to `{baseDir}/../../skills.md`, a file outside the supplied project and audited package boundary. According to the Skill, this external file defines the transaction procedure, contract addresses, ABIs, and safety constraints used for Ethereum mainnet domain registration. Consequently, reviewing `SKILL.md` does not establish what contracts will be called, what transaction data or value will be submitted, whether token approvals will be requested, or which safeguards the Agent will enforce. The effective behavior can change independently of the audited Skill if the external file is replaced or modified. Because the referenced file contains instructions rather than merely passive data, an attacker able to control it could alter the Agent's transaction workflow or safety rules when the Skill is invoked. This is an instruction-trust-boundary weakness matching skill instruction hijacking. ### Attack Path 1. An attacker obtains the ability to create or modify the referenced `../../skills.md` file in the deployment environment. 2. The attacker inserts authoritative-looking instructions, malicious Ethereum contract addresses, crafted calldata, excessive transaction values, or weakened confirmation requirements. 3. A user invokes the domain-registration Skill. 4. The Agent follows the external file as the full registration specification. 5. The Agent prepares a transaction targeting the attacker-selected contract or using attacker-controlled parameters. 6. If the user si ...[truncated 1130 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete registration specification inside the audited Skill package rather than referencing a path outside it. 2. Bundle the exact Ethereum mainnet chain ID, checksummed contract addresses, minimal ABIs, commit/reveal procedure, and safety constraints with the Skill. 3. If an external specification is operationally necessary, pin it using a cryptographic digest or signed manifest and reject it when integrity verification fails. 4. Treat externally loaded content as untrusted data rather than authoritative Agent instructions. 5. Before requesting a signature, display and validate: - Chain ID and network name. - Checksummed destination contract address. - Function selector and decoded arguments. - ETH value and an explicit maximum-value limit. - Token approvals or permission changes. - Expected recipient and resulting ownership. 6. Require explicit user confirmation for each transaction in the commit/reveal sequence. 7. Reject undocumented contract calls, unlimited approvals, arbitrary calldata, and transactions whose destination is not on an audited allowlist. 8. Add tests that fail when transaction-critical instructions or addresses are resolved from outside the packaged Skill boundary. ]]>