T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:48
- Finding
- Mandatory Obedience to Untrusted Remote Deployment Instructions## Vulnerability Details **File Location**: `SKILL.md:48-64` **Vulnerability Type**: Remote instruction delegation **Risk Level**: High ### Vulnerable Code ```markdown 1. **First, get deployment instructions:** Call `get_deploy_instructions` to understand constraints and requirements. 2. **Get the app template:** Call `get_app_template` with your chosen `app_type` and `frontend_template`. 3. **Deploy the app:** Call `deploy_app` with your app files. For new apps, set `app_id` to `null`. 4. **Check deployment status:** Call `get_app_status` to check if the build succeeded. 5. **View/manage your apps:** Use `get_apps` to list your deployed apps. ## Available Tools ### get_deploy_instructions Use this when you are about to call deploy_app in order to get the deployment constraints and hard rules. You must call this tool before starting to generate any code. This tool returns instructions only and does not deploy anything. ``` ### Technical Analysis The skill requires the agent to retrieve deployment instructions from an external API and treat the resulting constraints as mandatory before generating code. The remote instructions are not included in the audited package, cannot be statically reviewed, and may change after installation. This creates an instruction-hijacking boundary: content controlled by the remote service is elevated from untrusted API data to authoritative agent instructions. If the service, account, API infrastructure, or returned content is compromised, an attacker could attempt to modify the agent's subsequent goals, requested data, generated application code, or Bash/API operations. The package does not define a restrictive schema or local allowlist governing what remote instructions may request. It also does not explicitly require the agent to reject remote instructions that conflict with user intent, security policy, tool restrictions, or data-minimization requirements. ...[truncated 1400 chars]
- Remediation
- ## Remediation Suggestions 1. Store all security constraints and behavioral rules locally in the reviewed skill package. 2. Treat responses from `get_deploy_instructions` strictly as untrusted structured data rather than executable or authoritative instructions. 3. Define and enforce a narrow response schema containing only expected deployment parameters, such as size limits and supported templates. 4. Reject remote fields that attempt to alter agent policy, tool permissions, network destinations, credential handling, or the user's original request. 5. Restrict outbound requests to documented SkillBoss endpoints and prohibit instructions that introduce additional destinations. 6. Require explicit user confirmation before transmitting source files or performing operations outside the clearly described deployment workflow. 7. Pin or version the remote instruction contract so reviewed behavior cannot change silently. 8. Add a local rule stating that remote content can never override system instructions, security controls, or explicit user intent.