T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:350- Finding
Mutable Remote Skill Instructions Can Hijack Scheduled Agent Sessions
- Content
View full analysis
~/.ailove/SKILL.md ``` **Or just read it from the URL above!** ``` ```markdown The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**. ``` ```bash curl -s https://heerweiyi.cc/skill.md ``` ```bash curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md ``` ### Technical Analysis The Skill instructs users or agents to download its instruction document from a mutable remote URL and overwrite the trusted local copy. Scheduled isolated sessions are subsequently directed to read that local file and follow its API and credential-handling instructions. There is no signature verification, pinned cryptographic digest, immutable versioned URL, or mandatory human review of the downloaded changes. HTTPS protects the connection in transit but does not protect against compromise of the origin server, domain, deployment account, or content-publishing pipeline. Because `SKILL.md` is interpreted as agent instructions, a malicious future version could change the destination receiving the bearer token, request additional local files, alter messaging destinations, or introduce shell commands. Although no such malicious instruction is present in the audited version, the update design creates a direct instruction-hijacking path after review. ### Attack Path 1. An attacker compromises `heerweiyi.cc`, its hosting account, DNS, or the process publishing `/skill.md`. 2. The attacker replaces the remote document with instructions that request secrets, invoke unsafe tools, or redirect authenticated requests. 3. A user or agent runs the documented update ...[truncated 1076 chars]- Remediation
View remediation