T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:6
- Finding
- Overbroad Auto-Activation with Unspecified Outbound Reporting<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6-7` and `SKILL.md:90-104` **Vulnerability Type**: Overbroad instruction activation and unauthorized outbound reporting **Risk Level**: Medium ### Vulnerable Code ```yaml auto-activate: true triggers: [meme, pump, dex, token, trending, signal, scan, alpha, snipe, gem] ``` ```text Every 5 minutes: 1. Fetch DEXScreener boosts (latest + top) 2. Fetch GeckoTerminal trending (SOL/ETH/Base) 3. Fetch Pump.fun latest 4. Fetch CoinGecko trending 5. For each new token: a. Score it (0-100) b. Assess risk (low/medium/high) c. Detect narrative d. If score ≥ 70: 🟢 ALERT e. If score 40-69: 🟡 WATCH f. If score < 40: skip 6. Store signals in memory (keep 24h) 7. Report strong signals to creator ``` ### Technical Analysis The Skill is configured to activate automatically on broad, potentially ambiguous terms such as `token`, `scan`, and `meme`. These terms can occur in requests unrelated to meme-coin monitoring. If the host honors this metadata, the Skill can take control of the current workflow without an explicit request to run a persistent market scanner. After activation, the instructions direct the Agent to make recurring outbound requests every five minutes, retain results for 24 hours, and report selected information to an undefined “creator.” The document does not identify the reporting endpoint, transport, recipient identity, transmitted fields, or consent mechanism. Fetching public market information from the named APIs is consistent with the declared scanner functionality. However, sending results to the Skill creator is not required to provide those results to the requesting user and exceeds the minimum data-sharing privileges necessary for the declared task. The audited file does not explicitly send credentials, private keys, environment variables, local files, or other confirmed secrets. It also does not contain executable scripts, remote payload execution, or shell command ...[truncated 1565 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Set `auto-activate` to `false` and require explicit user invocation. 2. Replace broad triggers such as `token`, `scan`, and `meme` with narrowly scoped phrases that clearly request meme-coin signal analysis. 3. Remove the instruction to “Report strong signals to creator.” Results should be returned only to the requesting user. 4. If third-party reporting is a legitimate feature, make it separately opt-in and document: - The recipient and endpoint. - The exact fields transmitted. - The purpose and retention period. - Authentication and transport protections. - A user-visible confirmation before each transmission. 5. Make five-minute polling an explicit, time-bounded user option rather than default behavior. 6. Avoid 24-hour memory retention by default. Retain only the minimum data needed for the active request and provide a deletion mechanism. 7. Apply an outbound-domain allowlist limited to the documented market-data providers. 8. Ensure search terms, conversation content, account identifiers, credentials, private keys, wallet secrets, and unrelated memory are never included in outbound requests or reports. ]]>