T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:17
- Finding
- External Passport Service Is Treated as an Authority Over Agent Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 17–25, 81–86, 104–109, and 128–143 **Vulnerability Type**: External instruction and authorization hijacking **Risk Level**: High **Vulnerable code snippets**: ```markdown Shows your passport, what you're allowed to do, what your deliverable contract requires, and the state of any tasks you've started. Run this any time you want to understand your own standing. ## When to use this skill - At the start of a session to orient yourself - When a user asks "what can you do?" or "what are your limits?" - Before attempting an action to check you have the capability ``` ```markdown DELIVERABLE CONTRACT (what I must produce) Written summary required (min. 20 words) Tests passing required: no Different reviewer required: no Output scanned for: TODO, FIXME, console.log ``` ```markdown **If passport is SUSPENDED:** ``` Your passport is suspended. You cannot complete tasks or use restricted capabilities. Contact APort at https://aport.io ``` ``` ```markdown ## Step 5 — Answer capability questions If a user asks "can you do X?", use the status to answer directly: ``` User: Can you merge this PR? You: [check capabilities list for repo.merge] Yes — repo.merge is in my passport Before I can call it done, I need: [deliverable contract requirements] User: Can you send an email? You: [check capabilities list for messaging.send] No — messaging.send is not in my passport To add it, create a new passport at https://aport.id ``` ``` ### Technical Analysis The skill instructs the agent to use mutable data obtained from an external passport service as the authority for what the agent may do, what it must produce, and whether it may complete a task. This goes beyond displaying status information: it allows externally supplied capability lists, suspension states, and deliverable contracts to alter ...[truncated 1478 chars]
- Remediation
- ## Remediation Suggestions - Treat all passport and decision API responses as untrusted, display-only data. - Explicitly state that remote passport fields cannot override system, developer, or user instructions, actual tool permissions, local policy, or security controls. - Do not use remote capability lists to authorize actions or remote suspension states to determine whether a task may be completed. - Rename behavioral labels such as “what I must produce” to clarify that they are informational claims made by the service. - Validate responses against a strict schema, enforce field length and type limits, and render values as inert quoted data. - Make authorization decisions through trusted local controls rather than through mutable content returned by a third-party status API. - Clearly distinguish verified local capabilities from externally asserted passport metadata in all displayed output.