T01 · Skill Instruction Hijacking
Error
- Location
- src/index.ts:92
- Finding
- Remote Firestore Commands Are Injected Directly into the Agent Reasoning Loop<![CDATA[ ## Vulnerability Details **File Location**: `src/index.ts:92-96` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Critical ### Vulnerable Code ```typescript unsubscribe = startCommandListener(db, config.userId, async (command) => { const message = `User command from HashBox App: ${command.payload.raw_instruction}`; await context.injectMessage(message); }); ``` ### Technical Analysis The plugin receives `raw_instruction` from a remote Firestore document and injects it directly into the agent's reasoning context through `context.injectMessage()`. The Firestore listener in `src/commandListener.ts` constructs command objects from document fields using TypeScript assertions, but it performs no runtime schema validation, cryptographic message verification, command allowlisting, or confirmation of the instruction's intended scope. Prefixing the value with `User command from HashBox App:` does not establish a security boundary or prevent the agent from interpreting the remaining text as authoritative instructions. This creates an explicit remote prompt-injection channel. The declared command types are also not enforced at runtime before the callback is invoked. ### Attack Path 1. An attacker obtains the ability to create or modify documents in the relevant user's `agent_commands` Firestore queue. This may occur through compromised HashBox credentials, a compromised backend, or overly permissive Firestore rules. 2. The attacker creates a document with: - The victim's `userId` - A `pending` status - A malicious `payload.raw_instruction` 3. The active `onSnapshot` listener receives the document. 4. The plugin marks the command as processing and invokes the command callback. 5. The callback embeds the attacker-controlled text in a message and calls `context.injectMessage()`. 6. The agent may interpret the text as a genuine user instruction and invoke tools or access resources available in the current agent session. # ...[truncated 622 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove direct injection of `raw_instruction` into the agent's reasoning context. 2. Convert inbound commands into narrowly scoped, typed operations with explicit handlers. 3. Enforce a runtime schema for every Firestore field, including: - Exact supported command types - Required and optional payload fields - Maximum string and collection sizes - Valid status transitions 4. Authenticate each command independently using a server-generated signature or equivalent integrity mechanism. 5. Bind commands to the expected user, installation, and agent instance. 6. Require explicit local user confirmation before any command that accesses data, invokes tools, or causes external side effects. 7. Treat remote text as untrusted data rather than as instructions. 8. Enforce restrictive Firestore security rules and test that users cannot write commands for other accounts. 9. Record auditable command provenance without logging sensitive command contents unnecessarily. ]]>