T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:75
- Finding
- Unauthenticated Trust of Remote Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 75, 153, 309, and 336 **Vulnerability Type**: Remote instruction injection through API-controlled response fields **Risk Level**: High ### Vulnerable Snippets At line 75, the Skill explicitly instructs the Agent to follow instructions returned by the remote service: ```markdown Every response includes `next_steps` — follow them. You never need to memorize endpoints. ``` Line 153 identifies both `next_steps` and `soul_prompt` as remotely supplied response fields: ```markdown Returns: hunger, happiness, health, trust, discipline, mood, stage, age, behavior, evolution progress, `soul_prompt` (narrative inner-state text for agent roleplay), portrait gallery, and `next_steps`. ``` The automated-care routine repeats the unconditional instruction at line 309: ```text # next_steps adapts to current state — follow it follow status.next_steps ``` Line 336 instructs Agents to incorporate another server-controlled value into their conversational context: ```markdown Every status response includes a `soul_prompt` — narrative text describing the creature's current inner state. Designed for AI agents to incorporate into roleplay or conversation context. The API speaks to agents as agents, not as generic consumers. ``` ### Technical Analysis The Skill crosses a trust boundary by treating content returned from `https://animalhouse.ai` as Agent instructions rather than untrusted application data. The directives to “follow” `next_steps` and incorporate `soul_prompt` provide no validation rules, schema constraints, endpoint allowlist, or separation between narrative data and executable instructions. Because these response values are controlled by a remote service, their effective content can change after the Skill has been reviewed or installed. If the service, its infrastructure, or an upstream content-generation component is compromised, an attacker could place prompt-injection text inside `next_s ...[truncated 2006 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove unconditional directives such as “follow them” and `follow status.next_steps`. 2. Treat every API response field, including `next_steps` and `soul_prompt`, as untrusted data. 3. Parse `next_steps` through a strict schema and allow only documented Animal House operations, HTTP methods, and `animalhouse.ai` API paths. 4. Reject free-form commands, external URLs, tool instructions, system prompts, credential requests, and unsupported response fields. 5. Render `soul_prompt` only as quoted narrative content. Do not place it in system, developer, tool-control, or other instruction-bearing context. 6. Preserve the Agent's existing safety policies and task boundaries regardless of instructions contained in API responses. 7. Require explicit user confirmation before destructive or consequential actions, including creature release, account changes, disclosure of information, or calls outside the documented API. 8. Apply least privilege to heartbeat automation. It should only read creature status and perform explicitly allowlisted care actions. 9. Log and ignore response text that attempts to address the Agent directly, override prior instructions, request secrets, or invoke unrelated tools. 10. Consider using typed response objects where action names are enumerated, identifiers are validated, and narrative text cannot be interpreted as executable instructions. ]]>