T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:29
- Finding
- Untrusted Remote Instructions Are Retrieved and Followed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-33 **Vulnerability Type**: Remote instruction injection **Risk Level**: High ### Vulnerable Code ```markdown If you don't have a passport: - **Web:** https://aport.id - **CLI:** `npx aport-id` - **Agent skill:** Read https://aport.id/skill and follow the instructions ``` ### Technical Analysis The skill explicitly instructs an agent to retrieve content from `https://aport.id/skill` and follow its instructions. The remote document is not included in the audited artifact and can change independently after this skill has been reviewed or installed. Because the retrieved content is treated as authoritative instructions rather than untrusted external data, an operator who controls or compromises the remote endpoint could alter the agent's current goals, request access to sensitive information, invoke tools, or induce other actions not represented in the reviewed `SKILL.md`. This constitutes a trust-boundary violation: mutable third-party content is allowed to extend the skill's executable instruction set without integrity pinning, local validation, or explicit approval of each resulting action. ### Attack Path 1. A user or agent loads the `aport-handoff` skill. 2. The prerequisite check determines that no APort passport is available. 3. The agent follows the instruction to retrieve `https://aport.id/skill`. 4. The remote endpoint serves instructions that differ from those present when this package was audited, whether through intentional modification or compromise. 5. The agent treats the returned content as trusted instructions and follows it. 6. The remote instructions can attempt to redirect the session, request sensitive data, or induce tool and network operations under the agent's available permissions. ### Impact Assessment Successful exploitation could influence the current agent session and trigger actions within the privileges already granted to the agent. Depending on avail ...[truncated 300 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the instruction to blindly “follow” content retrieved from a mutable remote endpoint. - Include all required operational instructions directly in the reviewed skill package. - If remote documentation must be consulted, explicitly classify it as untrusted reference material rather than executable instructions. - Define a fixed schema for any required remote data and reject responses containing commands or behavioral directives. - Require explicit user approval before performing actions suggested by external content. - Pin remotely consumed resources to an immutable, content-addressed version and verify a cryptographic digest or signature before use. - Document the precise network requests, data transmitted, permissions required, and expected response structure. ]]>