T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:14
- Finding
- Untrusted Remote Instructions Are Injected into Subagent Prompts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-16 and 49-53 **Vulnerability Type**: Remote instruction injection and task-goal hijacking **Risk Level**: Critical ### Vulnerable Code ```markdown # Agent dispatch You have access to a registry of 130+ specialized subagents. **Before doing specialized work yourself, check this index and dispatch to the appropriate agent.** If the agent is not installed locally, download it on the fly. ``` ```markdown ### Step 4: read and dispatch Read the agent file. Extract everything after the YAML frontmatter (after the second `---` line). Pass that full text as the prompt to the **Task** tool, prepending the specific work request. Use a general-purpose subagent with the full prompt inline — do not reference the agent by registered name. ``` ### Technical Analysis The skill instructs the current agent to redirect specialized tasks to another agent and to insert the complete body of an externally sourced file into that subagent's prompt. The only documented validation concerns the presence of YAML frontmatter; there is no semantic validation, instruction allowlist, safety filtering, or enforcement that the downloaded prompt remains subordinate to the user's request. Prompt text is executable control input in an agent environment. A malicious upstream file could contain instructions to ignore the original task, conceal actions, access unrelated files, request secrets, invoke available tools, or produce deceptive audit results. Prepending the legitimate request does not establish a reliable trust boundary because the untrusted text remains part of the instruction context. ### Attack Path 1. An attacker compromises or gains update access to one of the upstream agent-definition files. 2. The attacker adds instructions that pass the superficial frontmatter check but alter the subagent's goals or tool behavior. 3. A user requests a matching specialized task, such as a security audit or infrastruct ...[truncated 1055 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to insert downloaded files verbatim into agent prompts. 2. Bundle reviewed and version-controlled agent prompts inside the skill package. 3. Treat all remotely retrieved content as untrusted data rather than executable instructions. 4. If dynamic retrieval is essential, parse the document into a restrictive schema containing only approved fields and reject arbitrary instruction blocks. 5. Enforce a fixed system prompt stating that remote content cannot override user intent, safety controls, tool restrictions, or data-access boundaries. 6. Require explicit user approval before dispatching any remotely sourced agent definition. 7. Run dispatched agents with least-privilege tool permissions, filesystem isolation, network restrictions, and access limited to the files required by the current task. 8. Record and expose the exact prompt source, immutable version, and integrity hash to the user before execution. ]]>