T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/search-registry.sh:70
- Finding
- Untrusted Mutable Registry Content Is Rendered Without an AI Trust Boundary## Vulnerability Details **File Location**: `scripts/search-registry.sh:8, 70-83, 92-181, 288-329` **Vulnerability Type**: Remote content-based skill instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```bash REPO_URL="https://github.com/unleashedbelial/agent-failure-registry" REPO_DIR="/tmp/agent-failure-registry" ``` ```bash # Function to clone or update repository setup_repo() { echo -e "${BLUE}Setting up Agent Failure Registry...${NC}" if [ -d "$REPO_DIR" ]; then echo "Repository exists, pulling latest changes..." cd "$REPO_DIR" git pull origin main 2>/dev/null || git pull origin master 2>/dev/null || echo "Pull failed, using existing repo" else echo "Cloning repository..." git clone "$REPO_URL" "$REPO_DIR" cd "$REPO_DIR" fi echo -e "${GREEN}Repository ready at $REPO_DIR${NC}" } ``` ```python def format_entry(data, file_path): if not data: return "" output = [] output.append(f"\n{'='*60}") output.append(f"📋 {data.get('title', 'Untitled')}") output.append(f"📁 Category: {data.get('category', 'unknown')}") output.append(f"🏷️ Tags: {', '.join(data.get('tags', []))}") output.append(f"📄 Source: {file_path}") output.append(f"{'='*60}") if data.get('summary'): output.append(f"\n💡 SUMMARY:") output.append(f"{data['summary']}") if data.get('root_cause'): output.append(f"\n🔍 ROOT CAUSE:") output.append(f"{data['root_cause']}") if data.get('fix'): output.append(f"\n✅ FIX:") output.append(f"{data['fix']}") if data.get('prevention'): output.append(f"\n🛡️ PREVENTION:") output.append(f"{data['prevention']}") if data.get('lessons'): output.append(f"\n📚 LESSONS LEARNED:") output.append(f"{data['lessons']}") confidence = data.get('confidence', 'unknown') output.append(f"\n🎯 Confidence: {co ...[truncated 4025 chars]
- Remediation
- ## Remediation Suggestions 1. **Pin upstream content** to a reviewed commit hash or signed, immutable release instead of pulling the latest branch automatically. 2. **Separate updates from searches**. Require an explicit update operation and show the repository URL, commit hash, and verification status before using new content. 3. **Treat every registry field as untrusted data**. Add explicit delimiters and a warning stating that record content must never be interpreted as instructions or authorization to use tools. 4. **Return structured data** rather than prose that resembles Agent instructions. Preserve provenance metadata for every result. 5. **Add submission security controls** that reject prompt-injection patterns, requests to ignore constraints, tool-use directives, secret requests, and unrelated operational commands. 6. **Require human review** of records before making them available to AI consumers. Review should address both sensitive-data disclosure and semantic prompt injection. 7. **Verify upstream authenticity and integrity** with signed commits or release artifacts and fail closed when verification cannot be completed. 8. **Apply least privilege at the caller level** so registry search results cannot independently authorize file, shell, credential, or network operations.