T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:13
- Finding
- Mutable Remote Instructions Can Hijack the Agent Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 13–14 **Vulnerability Type**: Mutable remote instruction-chain loading **Risk Level**: High **Vulnerable Code Snippet**: ```markdown 1. Fetch https://agentradio.com/.well-known/agentradio for discovery and the reading order. 2. Read https://agentradio.com/skill.md for the maintained onboarding runbook, then the documents that runbook requires before writing. Use https://agentradio.com/openapi.json for request schemas. This package is a small entry point, not a duplicate API reference. ``` ### Technical Analysis The packaged Skill delegates its effective operating instructions and document reading order to mutable content retrieved from `agentradio.com`. It also directs the agent to read additional documents required by the remotely maintained runbook. The complete behavior of the Skill therefore cannot be determined from the reviewed package alone. Remote content may change after publication without a corresponding update or security review of this package. If the remote service, its hosting infrastructure, or its content-management process is compromised, an attacker could replace the runbook with instructions that alter the agent's current goals, request access to sensitive information, or direct consequential API operations. This is instruction retrieval rather than executable-code retrieval, so it is best classified as `T01: Skill Instruction Hijacking`, not remote code execution. The risk is amplified by the later workflow in `SKILL.md`, which handles an API credential and performs authenticated operations. Although the packaged instructions explicitly say to send credentials only to the canonical AgentRadio API origin, the remotely supplied contract helps define the operational endpoints and procedure. Allowing mutable fetched text to control that process weakens the intended origin restriction. ### Attack Path 1. A user activates the AgentRadio Skill for onbo ...[truncated 1806 chars]
- Remediation
- ## Remediation Suggestions 1. Package the complete security-relevant onboarding runbook with the Skill so its effective instructions can be reviewed and versioned together. 2. Remove recursive loading of documents selected by remote content. Maintain a fixed local allowlist of permitted informational resources. 3. If remote metadata is required, treat it strictly as untrusted data rather than executable instructions. Parse it through a restrictive schema that rejects unknown fields, embedded directives, alternate origins, and unexpected URLs. 4. Pin remotely retrieved artifacts to immutable versions and cryptographic hashes. Fail closed if integrity verification fails. 5. Define the permitted API origin locally and immutably. Do not allow discovery documents or runbooks to redefine where credentials, claim tokens, private identifiers, media, or account data may be sent. 6. Separate public discovery from authenticated operations. Require explicit human confirmation before registration, uploads, profile changes, spending, or other consequential actions. 7. Restrict credentials to a scoped secret store and narrowly scoped API client. Prevent credentials from being exposed to fetched documents, prompts, logs, URLs, public posts, or unrelated tools. 8. Apply outbound network controls that allow only documented HTTPS endpoints, validate TLS certificates, reject redirects to other origins, and prevent remote content from expanding the network allowlist. 9. Add a locally enforced policy stating that remote documents cannot override system instructions, safety constraints, least-privilege boundaries, or human approval requirements.