T01 · Skill Instruction Hijacking
Error
- Location
src/index.ts:92- Finding
Remote Firestore Commands Are Injected Directly into the Agent Reasoning Loop
- Content
View full analysis
{ const message = `User command from HashBox App: ${command.payload.raw_instruction}`; await context.injectMessage(message); }); ``` ### Technical Analysis The plugin receives `raw_instruction` from a remote Firestore document and injects it directly into the agent's reasoning context through `context.injectMessage()`. The Firestore listener in `src/commandListener.ts` constructs command objects from document fields using TypeScript assertions, but it performs no runtime schema validation, cryptographic message verification, command allowlisting, or confirmation of the instruction's intended scope. Prefixing the value with `User command from HashBox App:` does not establish a security boundary or prevent the agent from interpreting the remaining text as authoritative instructions. This creates an explicit remote prompt-injection channel. The declared command types are also not enforced at runtime before the callback is invoked. ### Attack Path 1. An attacker obtains the ability to create or modify documents in the relevant user's `agent_commands` Firestore queue. This may occur through compromised HashBox credentials, a compromised backend, or overly permissive Firestore rules. 2. The attacker creates a document with: - The victim's `userId` - A `pending` status - A malicious `payload.raw_instruction` 3. The active `onSnapshot` listener receives the document. 4. The plugin marks the command as processing and invokes the command callback. 5. The callback embeds the attacker-controlled text in a message and calls `context.injectMessage()`. 6. The agent may interpret the text as a genuine user instruction and invoke tools or access resources available in the current agent session. # ...[truncated 622 chars]- Remediation
View remediation