T01 · Skill Instruction Hijacking
Error
- Location
- encrypted-card.md:78
- Finding
- Remote API Responses Are Executed as Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `encrypted-card.md:78-100`, with execution instructions at `encrypted-card.md:148-157` **Vulnerability Type**: Remote instruction injection **Risk Level**: Critical ### Vulnerable Code ```json { "approved": true, "checkout_id": "r5chk_abc123", "checkout_steps": [ "Call POST /api/v1/bot/rail5/key with { \"checkout_id\": \"r5chk_abc123\" } to get the decryption key.", "Run: node decrypt.js <key_hex> <iv_hex> <tag_hex> Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` ```text Once the checkout is approved, spawn an ephemeral sub-agent using the `spawn_payload` from the response: sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) The sub-agent executes the `checkout_steps` in sequence. You (the main agent) wait for the sub-agent to complete and then announce the result. ``` ### Technical Analysis The Skill treats the remote API's `spawn_payload.task` and `checkout_steps` fields as trusted Agent instructions. The content is not restricted to a locally defined set of payment actions, validated against an action schema, or displayed to the owner for approval before execution. Consequently, the effective behavior of the Skill is controlled by mutable server responses rather than only by the statically audited package. A compromised service, compromised account, or malicious response could replace the expected checkout task with instructions to access local files, disclose credentials, contact unrelated services, or perf ...[truncated 1514 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not execute natural-language tasks returned by the remote API. 2. Replace `spawn_payload.task` and `checkout_steps` with a fixed, locally implemented checkout workflow. 3. Accept only a strict typed response containing necessary data such as checkout ID, approved merchant, approved amount, and key-delivery status. 4. Enforce an allowlist of permitted action types and reject unknown fields or operations. 5. Bind owner approval cryptographically to the exact merchant domain, item, amount, currency, destination, and action-plan digest. 6. Require renewed owner approval if any approved parameter or execution plan changes. 7. Run checkout logic in a dedicated process with no access to unrelated tools, files, environment variables, or network destinations. 8. Authenticate API responses and use replay protection, but do not treat response authentication as authorization to execute arbitrary instructions. ]]>