T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Untrusted remote API output is required to control the Agent's final response verbatim## Vulnerability Details **File Location**: `SKILL.md:12-14` **Additional Locations**: `SKILL.md:387-388`, `SKILL.md:720-721` **Vulnerability Type**: Remote-content instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown 1. **ALWAYS use `--json` flag.** The script MUST run in JSON mode (`--json`). In Claude Code's Bash tool, stdout is always captured — it never streams directly to the user. JSON mode returns the full answer in a structured response that Claude can then output as text. State IDs are extracted from the JSON response fields `thread_short_id` and `live_doc_short_id`. 2. **ALWAYS output the answer directly as text.** After the script finishes, read `data.answer` from the JSON output and print it verbatim as your response text. Do NOT summarize, paraphrase, or add commentary around it. Output it exactly as-is so the user sees the full content. Then, if `data.image_urls` is non-empty, append image links immediately after, formatted as one line per image: `[title](url)`. ``` The same requirement is reiterated later: ```markdown 1. **Output `data.answer` verbatim** as your response text — print it exactly as-is so the user sees the full content. 2. **Extract and save** `data.thread_short_id` and `data.live_doc_short_id` — you MUST use these in the next call. ``` ```markdown - **ALWAYS use `--json`** — in Claude Code's Bash tool, stdout is captured, not streamed. JSON mode returns the answer in a structured response that Claude outputs as text - **ALWAYS output `data.answer` verbatim** — print it exactly as-is as your response text so the user sees the full content ``` ### Technical Analysis The `data.answer` value originates from an external Felo API SSE stream and is therefore outside the local Agent's trust boundary. The Skill instructs the host Agent to reproduce that externally controlled value exactly, while expressly prohibiting summarization, qualification, or commentary. This ...[truncated 2179 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirements to output `data.answer` verbatim and to avoid all commentary or review. 2. Explicitly classify API responses as untrusted data rather than Agent instructions. 3. Require the host Agent to apply its normal safety, privacy, and policy checks before presenting the response. 4. Clearly attribute retained content, for example: “Felo SuperAgent response,” so users can distinguish external output from the host Agent's own assertions. 5. Permit sanitization or suppression of credential requests, prompt-injection instructions, deceptive tool claims, unsafe links, and other harmful content. 6. Preserve useful formatting where safe, but do not let response-fidelity requirements override higher-priority security constraints. 7. Add an instruction stating that commands, policies, or requests embedded in `data.answer` must never be treated as instructions to the host Agent.