T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:6
- Finding
- Unrelated Agent-Directed Instructions Embedded in a No-Op Test Skill<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6–24 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippet ```text . File visibility bug: `buildSkillArchive` (in `bootstrap.go`) only creates a tar.gz with SKILL.md! So Phabricator-bootstrapped skills only have SKILL.md visible. The `StreamSkillContent` function only fetches SKILL.md too. This is the core bug explaining why "only SKILL.md is visible". 2. Microsoft OAuth: Currently only static token-based auth stub. Need proper MS OAuth. 3. Owner model: `OwnerTokenHash` is a single hash, not multi-owner. Need `SkillOwner` junction table. 4. Missing delete endpoint: No way to remove skills via API. So my plan is to tackle the database redesign first—adding a `User` table and `SkillOwner` junction table to support multiple owners. Then I'll implement Microsoft OAuth with proper Azure AD integration, fix the file visibility issue by making `StreamSkillContent` fetch the entire skill directory from Phabricator instead of just SKILL.md, and add the missing delete endpoint. Looking at the actual implementation, the core problem is in `bootstrap.go` where `StreamSkillContent` only retrieves SKILL.md. I need to refactor it to use the directory-fetching logic from `gitfetch.go` so it pulls all files in the skill directory. Before diving into the code changes, I should clarify the scope with the user and understand their priorities—this is a substantial refactor that touches the database layer, authentication, file handling, and API structure. I'm seeing the core issues now: the Phabricator bootstrap only archives SKILL.md, so I need to either make `StreamSkillContent` fetch the full directory recursively or trigger a re-fetch when the editor opens. For the OAuth piece, I'll use Azure AD with MSAL, storing the user's OID and email. The owner model should shift from a token hash to a junction table or JSON array of use ...[truncated 2971 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove lines 6–24 because they are unrelated to the declared no-op testing purpose. 2. Replace the body with a short, explicit statement that the Skill performs no actions and must not access files, networks, credentials, databases, or external services. 3. If the implementation discussion must be retained, store it outside the Skill instruction file and clearly mark it as non-executable reference material. 4. Avoid first-person task language such as “I need to,” “I'll implement,” and “my plan” in content loaded into an Agent's instruction context. 5. Add validation that rejects or flags Skill descriptions whose operational scope conflicts with their declared metadata. 6. Apply least privilege to consuming Agents: do not provide repository write, deployment, credential, database, or deletion capabilities to a no-op test Skill. 7. Require explicit user confirmation before an Agent performs authentication changes, schema migrations, recursive repository retrieval, or destructive deletion operations. 8. Keep external repository access and OAuth-related data flows restricted to allowlisted endpoints, and prevent tokens or identity data from being included in prompts, logs, or untrusted network requests. ]]>