T01 · Skill Instruction Hijacking
Warning
- Location
scripts/search-registry.sh:70- Finding
Untrusted Mutable Registry Content Is Rendered Without an AI Trust Boundary
- Content
View full analysis
Vulnerability Details
File Location:
scripts/search-registry.sh:8, 70-83, 92-181, 288-329
Vulnerability Type: Remote content-based skill instruction hijacking
Risk Level: MediumVulnerable Code
bash REPO_URL="https://github.com/unleashedbelial/agent-failure-registry" REPO_DIR="/tmp/agent-failure-registry"bash # Function to clone or update repository setup_repo() { echo -e "${BLUE}Setting up Agent Failure Registry...${NC}" if [ -d "$REPO_DIR" ]; then echo "Repository exists, pulling latest changes..." cd "$REPO_DIR" git pull origin main 2>/dev/null || git pull origin master 2>/dev/null || echo "Pull failed, using existing repo" else echo "Cloning repository..." git clone "$REPO_URL" "$REPO_DIR" cd "$REPO_DIR" fi echo -e "${GREEN}Repository ready at $REPO_DIR${NC}" }python def format_entry(data, file_path): if not data: return "" output = [] output.append(f"\n{'='*60}") output.append(f"📋 {data.get('title', 'Untitled')}") output.append(f"📁 Category: {data.get('category', 'unknown')}") output.append(f"🏷️ Tags: {', '.join(data.get('tags', []))}") output.append(f"📄 Source: {file_path}") output.append(f"{'='*60}") if data.get('summary'): output.append(f"\n💡 SUMMARY:") output.append(f"{data['summary']}") if data.get('root_cause'): output.append(f"\n🔍 ROOT CAUSE:") output.append(f"{data['root_cause']}") if data.get('fix'): output.append(f"\n✅ FIX:") output.append(f"{data['fix']}") if data.get('prevention'): output.append(f"\n🛡️ PREVENTION:") output.append(f"{data['prevention']}") if data.get('lessons'): output.append(f"\n📚 LESSONS LEARNED:") output.append(f"{data['lessons']}") confidence = data.get('confidence', 'unknown') output.append(f"\n🎯 Confidence: {co ...[truncated 4025 chars]- Remediation
View remediation
Remediation Suggestions
- Pin upstream content to a reviewed commit hash or signed, immutable release instead of pulling the latest branch automatically.
- Separate updates from searches. Require an explicit update operation and show the repository URL, commit hash, and verification status before using new content.
- Treat every registry field as untrusted data. Add explicit delimiters and a warning stating that record content must never be interpreted as instructions or authorization to use tools.
- Return structured data rather than prose that resembles Agent instructions. Preserve provenance metadata for every result.
- Add submission security controls that reject prompt-injection patterns, requests to ignore constraints, tool-use directives, secret requests, and unrelated operational commands.
- Require human review of records before making them available to AI consumers. Review should address both sensitive-data disclosure and semantic prompt injection.
- Verify upstream authenticity and integrity with signed commits or release artifacts and fail closed when verification cannot be completed.
- Apply least privilege at the caller level so registry search results cannot independently authorize file, shell, credential, or network operations.